{"id":"TECH-202610-unpatched-broadcom-wi-fi-wps-flaw-wpsplinter-lets-anyone-in-","kind":"technique","aliases":[],"related":[],"title":"Unpatched Broadcom Wi-Fi WPS flaw (WPSplinter) lets anyone in radio range run code on routers and access points without the Wi-Fi password","description":null,"summary":"Researcher Quentin Kaiser disclosed WPSplinter at Hexacon on 2026-10-16. Broadcom's legacy WPS Monitor code, in its Wi-Fi SDK since at least 2010, does not check that reassembled EAP-WPS fragments fit their buffer. An attacker within Wi-Fi range can reach this code before any pairing, with no PIN, button press or network key. The attacker can then read device memory and run code. Kaiser showed the Wi-Fi password (PSK) being stolen over the air from an Askey TCG3000 (Orange Belgium) and a remote shell running over Wi-Fi frames on a Sagemcom Proximus BBOX3V+. Broadcom says it replaced the code in 2018 (with hostapd), but it calls the old code obsolete and declined to assign a CVE. Many vendors never shipped the fix. eCos-based chips (BCM3380, BCM3383, BCM33834) are a forever-day; Linux-based chips (BCM3390, BCM63xx, BCM65xx, BCM68xx) depend on OEM firmware. The researcher's list of affected devices includes office gear: Cisco RV110W, RV130W, RV215W and RV340W routers and Cisco WAP121, WAP125, WAP150, WAP361, WAP371, WAP571, WAP571E and WAP581 access points. It also includes many ISP gateways and Netgear, ASUS, D-Link, Huawei, NetComm, ARRIS and Actiontec models. The list is not exhaustive. At risk: offices and remote workers whose Wi-Fi runs on these devices. The attack range has not been published. No attacks in the wild have been reported.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Broadcom Wi-Fi SDK (WPS Monitor)","fixed":[],"affected":"legacy WPS Monitor implementation (SDK since at least 2010)","ecosystem":"vendor"},{"name":"Cisco RV110W / RV130W / RV215W / RV340W","fixed":[],"affected":"all versions (per researcher)","ecosystem":"vendor"},{"name":"Cisco WAP121 / WAP125 / WAP150 / WAP361 / WAP371 / WAP571 / WAP571E / WAP581","fixed":[],"affected":"all versions (per researcher)","ecosystem":"vendor"},{"name":"Netgear / ASUS / D-Link / Huawei / NetComm / ARRIS / Askey / Actiontec routers and gateways","fixed":[],"affected":"models listed at qkaiser.github.io/broadcom-wps","ecosystem":"vendor"}],"ecosystems":[],"tags":["broadcom","early-warning","no-patch","routers","technique","wifi"],"not_affected_if":[],"how_to_check":"- Compare your Wi-Fi routers, access points and ISP gateways (including remote workers' home gateways) with the affected-device list at https://qkaiser.github.io/broadcom-wps/. Cisco RV110W/RV130W/RV215W/RV340W and WAP121/125/150/361/371/571/571E/581 are listed as affected in all versions.\\n- Use the researcher's fingerprinting tool (github.com/qkaiser/broadcom-wps) to spot access points running the Broadcom SDK.\\n- A device that uses hostapd instead of Broadcom's WPS Monitor (wps_monitor) is not affected by this bug.\\n- Indicators of compromise: unknown.","fix":"- There is no CVE, and no vendor has published a fixed firmware version. Ask your device vendor or ISP for firmware that replaces Broadcom's legacy WPS Monitor, and install it when it ships.\\n- Replace devices that will get no update. Many listed models, including eCos-based cable gateways, are end of life.\\n- Turning off WPS may not help, per the researcher. Changing the Wi-Fi password does not help either: the bug is reachable before authentication, and a compromised device can leak the new password.\\n- Until you can patch or replace, do not treat Wi-Fi on affected devices as a trust boundary. Put wireless clients behind a separate segment, and require VPN or zero-trust access to internal services.","status":"open","published_at":"2026-10-16T00:00:00+00:00","first_seen_at":"2026-10-27T08:25:09+00:00","triaged_at":"2026-10-27T08:25:09+00:00","updated_at":"2026-10-27T08:25:09+00:00","category":"infrastructure","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-10':94B '-16':95B '-202610':28A '2010':111B '2018':197B '2026':93B 'access':19A,271B 'actiontec':71A,289B 'affect':248B 'air':168B 'also':274B 'and':73A 'anyon':10A 'anyone':38A 'arri':287B 'arris':69A 'askey':70A,171B 'assign':210B 'asus':63A,281B 'attack':125B,147B,311B,318B 'base':221B,233B 'bbox3v':189B 'bcm3380':223B 'bcm3383':224B 'bcm33834':225B 'bcm3390':235B 'bcm63xx':236B 'bcm65xx':237B 'bcm68xx':238B 'belgium':174B 'broadcom':2A,31A,41A,75B,96B,190B 'buffer':123B 'button':141B 'call':202B 'check':114B 'chip':222B,234B 'cisco':48A,53A,253B,261B 'code':15A,101B,134B,155B,195B,205B 'cve':212B 'd':65A,283B 'd-link':64A,282B 'day':230B 'declin':208B 'depend':239B 'devic':151B,249B,309B 'disclos':88B 'eap':118B 'eap-wp':117B 'earli':77B 'early-warn':76B 'eco':220B 'ecos-bas':219B 'exhaust':295B 'fi':5A,25A,33A,44A,106B,129B,161B,183B,305B 'firmwar':242B 'fit':121B 'fix':218B 'flaw':7A,35A 'forev':229B 'forever-day':228B 'fragment':120B 'frame':184B 'gateway':278B 'gateways':74A 'gear':252B 'hexacon':91B 'hostapd':199B 'huawei':67A,285B 'in':39A 'includ':250B,275B 'isp':277B 'kaiser':87B,156B 'key':145B 'least':110B 'legaci':98B 'let':9A 'lets':37A 'link':66A,284B 'linux':232B 'linux-bas':231B 'list':246B,292B 'mani':213B,276B 'memori':152B 'model':290B 'monitor':47A,100B 'netcomm':68A,286B 'netgear':62A,280B 'network':144B 'never':215B 'no-patch':79B 'obsolet':206B 'oem':241B 'offic':251B,298B 'old':204B 'orang':173B 'pair':137B 'password':26A,162B 'patch':81B 'pin':140B 'point':20A,272B 'press':142B 'proximus':188B 'psk':163B 'publish':316B 'quentin':86B 'radio':12A 'rang':13A,130B,312B 'reach':132B 'read':150B 'reassembl':116B 'remot':177B,300B 'replac':193B 'report':324B 'research':85B,244B 'risk':297B 'router':17A,82B,259B 'routers':72A 'run':14A,154B,179B,306B 'rv110w':49A,254B 'rv130w':50A,255B 'rv215w':51A,256B 'rv340w':52A,258B 'sagemcom':187B 'say':191B 'sdk':45A,107B 'shell':178B 'ship':216B 'show':157B 'sinc':108B 'stolen':165B 'tcg3000':172B 'tech':27A 'techniqu':83B 'unpatch':1A 'unpatched':30A 'unpatched-broadcom-wi-fi-wps-flaw-wpsplinter-lets-anyone-in':29A 'vendor':214B 'wap121':54A,262B 'wap125':55A,263B 'wap150':56A,264B 'wap361':57A,265B 'wap371':58A,266B 'wap571':59A,267B 'wap571e':60A,268B 'wap581':61A,270B 'warn':78B 'whose':302B 'wi':4A,24A,32A,43A,105B,128B,160B,182B,304B 'wi-fi':3A,23A,42A,104B,127B,159B,181B,303B 'wifi':84B 'wild':321B 'within':126B 'without':21A 'worker':301B 'wps':6A,34A,46A,99B,119B 'wpsplinter':8A,36A,40A,89B","nicknames":["WPSplinter"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202610-unpatched-broadcom-wi-fi-wps-flaw-wpsplinter-lets-anyone-in-","url":null,"severity":null,"published_at":"2026-10-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-27T08:25:09+00:00","fetched_at":"2026-10-27T08:25:09+00:00","note":null}],"documents":[{"id":5603,"url":"https://news.ycombinator.com/item?id=50255635","title":"Broadcom WPS flaw leaves routers exposed to over-the-air takeover","kind":"post","source":"hackernews","text":"Broadcom WPS flaw leaves routers exposed to over-the-air takeover\nhttps://meridian.news/p/8039333079430032961/\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-27T07:20:54+00:00","relation":"describes","confidence":null,"note":null},{"id":5670,"url":"https://qkaiser.github.io/broadcom-wps/","title":"WPSplinter: Broadcom WPS EAP fragment reassembly vulnerability","kind":"blog","source":"analyst","text":"Researcher Quentin Kaiser (Hexacon 2026). Broadcom legacy WPS Monitor does not constrain reassembled EAP-WPS fragments to the destination buffer size. Nearby attacker over Wi-Fi, no network key or WPS enrollment needed; controlled memory disclosure and arbitrary code execution. Broadcom declined a CVE. Affected device list (not exhaustive) includes Actiontec (CenturyLink/Frontier), ARRIS BGW210-700/NVG589/NVG599 (AT&T), ARRIS/CommScope X5001 (Xfinity), Askey TCG3000 (Orange Belgium, VOO), ASUS DSL-AC68U/DSL-AX82U and others, Cisco RV110W/RV130W/RV215W/RV340W and WAP121/125/150/361/371/571/571E/581, D-Link DSL series, Huawei HG/Speedport, NetComm NF series, Netgear CG3100/CG3700B/D6200/D6220/D6300/D6400/D7000/D8500/DGN2200. Fingerprinting tool: github.com/qkaiser/broadcom-wps.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":5671,"url":"https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/","title":"One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux","kind":"blog","source":"analyst","text":"Long-form version of Quentin Kaiser's Hexacon talk (2026-10-16). Bug in Broadcom proprietary 802.11 WPS code present in SDK since at least 2010; incomplete patch silently released in 2018, then SDK replaced vulnerable components with hostapd. Forever day on eCos platforms (BCM3380, BCM3383, BCM33834), potential forever day on Linux platforms (BCM3390, BCM63xx, BCM65xx, BCM68xx) unless OEMs ship updated firmware. Demonstrated PSK theft over the air on Askey TCG3000 (Orange Belgium) and over-Wi-Fi remote shell on Sagemcom Proximus BBOX3V+. Telenet stated not affected (edit 2026-10-20).","published_at":"2026-10-16T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}