Unpatched Broadcom Wi-Fi WPS flaw (WPSplinter) lets anyone in radio range run code on routers and access points without the Wi-Fi password

Researcher Quentin Kaiser disclosed WPSplinter at Hexacon on 2026-10-16. Broadcom's legacy WPS Monitor code, in its Wi-Fi SDK since at least 2010, does not check that reassembled EAP-WPS fragments fit their buffer. An attacker within Wi-Fi range can reach this code before any pairing, with no PIN, button press or network key. The attacker can then read device memory and run code. Kaiser showed the Wi-Fi password (PSK) being stolen over the air from an Askey TCG3000 (Orange Belgium) and a remote shell running over Wi-Fi frames on a Sagemcom Proximus BBOX3V+. Broadcom says it replaced the code in 2018 (with hostapd), but it calls the old code obsolete and declined to assign a CVE. Many vendors never shipped the fix. eCos-based chips (BCM3380, BCM3383, BCM33834) are a forever-day; Linux-based chips (BCM3390, BCM63xx, BCM65xx, BCM68xx) depend on OEM firmware. The researcher's list of affected devices includes office gear: Cisco RV110W, RV130W, RV215W and RV340W routers and Cisco WAP121, WAP125, WAP150, WAP361, WAP371, WAP571, WAP571E and WAP581 access points. It also includes many ISP gateways and Netgear, ASUS, D-Link, Huawei, NetComm, ARRIS and Actiontec models. The list is not exhaustive. At risk: offices and remote workers whose Wi-Fi runs on these devices. The attack range has not been published. No attacks in the wild have been reported.

Summary written from the sources below. Check the originals before acting.