WPS router flaw gives nearby attackers root access
A WPS router flaw in Broadcom Wi-Fi software allows someone within radio range to run code with root privileges, the highest level of control on the device, without knowing the network password or completing a pairing process. A security researcher disclosed the vulnerability on October 16 after demonstrating it against home gateways supplied by three Belgian internet providers. No CVE identifier has been assigned, and the researcher says no fix has been deployed to the affected routers.
The vulnerability affects Broadcom's implementation of Wi-Fi Protected Setup (WPS), a feature designed to connect devices to a wireless network without manually entering its password. During setup, WPS messages can arrive in separate fragments that the router must combine. The software handles that reassembly incorrectly, allowing specially constructed messages sent over Wi-Fi to corrupt the router's memory. The researcher used this weakness both to retrieve data from memory and to execute additional code on a targeted device.
One demonstration targeted an Askey TCG3000 gateway supplied by Orange Belgium. The exploit obtained the Wi-Fi pre-shared key (PSK), which is the password stored by the router, transmitted it back over the wireless connection and then used it to join the network. On a Sagemcom-built BBOX3V+ supplied by Proximus, the exploit created a reverse shell, meaning a remote command line through which the device could be controlled. That connection travelled through Wi-Fi frames, the small units used to carry wireless communications, and did not require an external server.
Both demonstrations worked without a login. The researcher also said the attack was not limited to very close physical proximity, although an attacker would still need to be within radio range. The working exploits were created by the researcher, who reported no evidence that the vulnerability has been used in real attacks.
The affected code is incorporated into routers and wireless access points sold by dozens of vendors. The researcher estimates that millions of devices could be affected, but the published device list includes different levels of certainty. Some entries are confirmed, while others have not been tested directly or were classified as likely vulnerable by an automated check. In Belgium, the flaw was found to be exploitable on gateways from Proximus, Orange Belgium and VOO, three of the country's four large providers. Equipment from Telenet might also be affected, but the researcher was unable to test it. Estimated totals for each affected Belgian provider reach hundreds of thousands of gateways, although the researcher described those numbers as rough.
The vulnerable chipsets are divided into older eCos-based and newer Linux-based families. The older group consists of the BCM3380, BCM3383 and BCM33834. The researcher found no usable correction for those models and describes the vulnerability as a forever day, a security flaw expected to remain unpatched for the lifetime of the affected hardware. The newer BCM3390, BCM65xx and BCM68xx families could potentially be corrected if device manufacturers move to different Wi-Fi software.
The researcher traced the vulnerable code to at least 2010. According to the researcher's account, Broadcom released an incomplete correction in 2018 and subsequently advised customers to replace the affected Wi-Fi component with hostapd, another software package used to operate wireless access points. No working correction was shipped for the older eCos chips, the researcher said.
There is also no Common Vulnerabilities and Exposures (CVE) record, the standard identifier used to track a publicly known security flaw. The researcher said Broadcom reported that it had known about the problem since 2018 and had received information about it from other parties, but would not assign a CVE or make a public statement. The researcher believes the absence of a public identifier contributed to device manufacturers failing to issue corrections. When the case was submitted to the CERT Coordination Center, it was closed the same day because Broadcom holds authority to assign CVEs for its products and would not create one. The Hacker News found no CVE for the flaw as of October 19.
There is currently no patch for users to install, and the researcher did not identify a router setting that blocks the over-the-air attack. The available detection resources are intended for technical investigation rather than direct protection. Published YARA rules can search extracted firmware, the software stored inside a router, for the vulnerable code. A separate script can listen to a working access point and report whether it appears vulnerable. The researcher cautions that both methods are triage tools: corrected equipment can still produce a match, so a result requires further examination and does not by itself confirm that a device is exploitable.
For organisations assessing affected network equipment and planning replacement, AEU-I offers security-first IT, infrastructure and consulting. Owners of devices that cannot receive a working correction may need to replace them, while customers using provider-issued gateways should ask their internet provider whether their exact model and software are affected.