Most of us never think about the little blinking box that runs our home internet. A new security disclosure is a good reason to start. On October 16, security researcher Quentin Kaiser presented research at the Hexacon conference in Paris showing that a flaw in Broadcom’s Wi-Fi setup software can let an attacker within radio range take over certain routers, without knowing the Wi-Fi password.

The bug isn’t new. Kaiser traces the vulnerable code back to at least 2010. And for some devices, there may never be a fix.

What the flaw is

The problem lives in Broadcom’s implementation of Wi-Fi Protected Setup, or WPS, the feature that lets you connect a device by pressing a button or entering a short PIN instead of typing your full password.

According to The Hacker News, Broadcom’s code mishandles the reassembly of fragmented WPS setup messages. An attacker in range can send specially crafted messages that corrupt the router’s memory. From there, Kaiser built tools to read data off the device and to run his own code on it with root, or full administrator, privileges.

Crucially, the attacker doesn’t need to complete the WPS pairing process or know the network password. They just need to be within Wi-Fi range, and Kaiser says the attack works at a distance, not only up close.

Demonstrated on real ISP gateways

Kaiser showed the attack working on home gateways supplied by Belgian internet providers. Against one device, his exploit read the stored Wi-Fi password and used it to join the network. Against another, it opened a remote command shell carried entirely over Wi-Fi.

He found the flaw present and exploitable on gateways from three of Belgium’s four big providers. He has reported no real-world attacks using the bug; the working exploits are his own research.

How widespread is it?

Broadcom’s Wi-Fi code is built into routers and access points from many vendors, and Kaiser estimates millions of devices worldwide are affected. Security Affairs notes the flaw has been present in Broadcom’s software development kit since at least 2010.

The affected chips fall into two groups:

  • Older eCos-based chips (BCM3380, BCM3383 and BCM33834), where Kaiser found no usable fix. He calls this a “forever-day,” a flaw that will never be patched on those devices.
  • Newer Linux-based chips (BCM3390, BCM65xx and BCM68xx), which could be fixed if device makers switch to different Wi-Fi software.

Kaiser also published a wider list of potentially affected gear, but it mixes confirmed and unconfirmed entries, so a device appearing on it isn’t proof that it’s vulnerable.

Why there’s no patch or CVE

According to Kaiser, Broadcom shipped an incomplete fix in 2018 and advised customers to move to an open-source Wi-Fi package called hostapd instead. He says Broadcom told him it had known about the bug since 2018 but declined to register a CVE, the public identifier that helps vendors and defenders track flaws. When he took the case to the CERT Coordination Center, it was closed the same day because Broadcom holds the authority to assign CVEs for its own products. As of October 19, The Hacker News found no CVE for the flaw.

Without a CVE, many device makers may simply never have been prompted to patch.

What you can do

There’s no patch to install and, per Kaiser, no setting known to block the attack over the air. That doesn’t mean you’re helpless. Sensible steps include:

  • Find out what you have. Check the make and model on the bottom of your router or in your provider’s app. If your internet provider supplied it, ask them whether it’s affected and whether a replacement is available.
  • Keep firmware updated. Turn on automatic updates if your router offers them, so any future fixes arrive quickly.
  • Retire very old hardware. For gear that will never be fixed, replacement is the practical option. A router that no longer gets updates is a risk beyond this one bug.
  • Watch for strangers on your network. Many router apps list connected devices. Anything unfamiliar is worth investigating.

For IT teams, Kaiser has released detection rules for scanning extracted firmware and a script that listens to a live access point to flag likely vulnerable devices. He cautions that both are triage tools, not definitive verdicts.

The bigger lesson

The router is the front door to every device in your home, and it’s often the least maintained gadget we own. This disclosure is a reminder that “it still works” isn’t the same as “it’s still safe.” Spend ten minutes this week checking what’s running your Wi-Fi and whether it’s still getting updates.

Image: ELECOM WRC-300FEBK WPS WiFi router 2 by Syced via Wikimedia Commons, CC0 1.0