--- id: "TECH-202610-unpatched-broadcom-wi-fi-wps-flaw-wpsplinter-lets-anyone-in-" kind: "technique" aliases: [] title: "Unpatched Broadcom Wi-Fi WPS flaw (WPSplinter) lets anyone in radio range run code on routers and access points without the Wi-Fi password" severity: "high" cvss: null epss: null exploited: false status: "open" category: "infrastructure" products: [{"name": "Broadcom Wi-Fi SDK (WPS Monitor)", "fixed": [], "affected": "legacy WPS Monitor implementation (SDK since at least 2010)", "ecosystem": "vendor"}, {"name": "Cisco RV110W / RV130W / RV215W / RV340W", "fixed": [], "affected": "all versions (per researcher)", "ecosystem": "vendor"}, {"name": "Cisco WAP121 / WAP125 / WAP150 / WAP361 / WAP371 / WAP571 / WAP571E / WAP581", "fixed": [], "affected": "all versions (per researcher)", "ecosystem": "vendor"}, {"name": "Netgear / ASUS / D-Link / Huawei / NetComm / ARRIS / Askey / Actiontec routers and gateways", "fixed": [], "affected": "models listed at qkaiser.github.io/broadcom-wps", "ecosystem": "vendor"}] ecosystems: [] tags: ["broadcom", "early-warning", "no-patch", "routers", "technique", "wifi"] not_affected_if: [] published_at: "2026-10-16T00:00:00+00:00" first_seen_at: "2026-10-27T08:25:09+00:00" updated_at: "2026-10-27T08:25:09+00:00" sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-27T08:25:09+00:00"}] --- # Unpatched Broadcom Wi-Fi WPS flaw (WPSplinter) lets anyone in radio range run code on routers and access points without the Wi-Fi password Researcher Quentin Kaiser disclosed WPSplinter at Hexacon on 2026-10-16. Broadcom's legacy WPS Monitor code, in its Wi-Fi SDK since at least 2010, does not check that reassembled EAP-WPS fragments fit their buffer. An attacker within Wi-Fi range can reach this code before any pairing, with no PIN, button press or network key. The attacker can then read device memory and run code. Kaiser showed the Wi-Fi password (PSK) being stolen over the air from an Askey TCG3000 (Orange Belgium) and a remote shell running over Wi-Fi frames on a Sagemcom Proximus BBOX3V+. Broadcom says it replaced the code in 2018 (with hostapd), but it calls the old code obsolete and declined to assign a CVE. Many vendors never shipped the fix. eCos-based chips (BCM3380, BCM3383, BCM33834) are a forever-day; Linux-based chips (BCM3390, BCM63xx, BCM65xx, BCM68xx) depend on OEM firmware. The researcher's list of affected devices includes office gear: Cisco RV110W, RV130W, RV215W and RV340W routers and Cisco WAP121, WAP125, WAP150, WAP361, WAP371, WAP571, WAP571E and WAP581 access points. It also includes many ISP gateways and Netgear, ASUS, D-Link, Huawei, NetComm, ARRIS and Actiontec models. The list is not exhaustive. At risk: offices and remote workers whose Wi-Fi runs on these devices. The attack range has not been published. No attacks in the wild have been reported. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Broadcom Wi-Fi SDK (WPS Monitor) affected legacy WPS Monitor implementation (SDK since at least 2010) fixed ? - vendor:Cisco RV110W / RV130W / RV215W / RV340W affected all versions (per researcher) fixed ? - vendor:Cisco WAP121 / WAP125 / WAP150 / WAP361 / WAP371 / WAP571 / WAP571E / WAP581 affected all versions (per researcher) fixed ? - vendor:Netgear / ASUS / D-Link / Huawei / NetComm / ARRIS / Askey / Actiontec routers and gateways affected models listed at qkaiser.github.io/broadcom-wps fixed ? ## How to check - Compare your Wi-Fi routers, access points and ISP gateways (including remote workers' home gateways) with the affected-device list at https://qkaiser.github.io/broadcom-wps/. Cisco RV110W/RV130W/RV215W/RV340W and WAP121/125/150/361/371/571/571E/581 are listed as affected in all versions.\n- Use the researcher's fingerprinting tool (github.com/qkaiser/broadcom-wps) to spot access points running the Broadcom SDK.\n- A device that uses hostapd instead of Broadcom's WPS Monitor (wps_monitor) is not affected by this bug.\n- Indicators of compromise: unknown. ## Fix - There is no CVE, and no vendor has published a fixed firmware version. Ask your device vendor or ISP for firmware that replaces Broadcom's legacy WPS Monitor, and install it when it ships.\n- Replace devices that will get no update. Many listed models, including eCos-based cable gateways, are end of life.\n- Turning off WPS may not help, per the researcher. Changing the Wi-Fi password does not help either: the bug is reachable before authentication, and a compromised device can leak the new password.\n- Until you can patch or replace, do not treat Wi-Fi on affected devices as a trust boundary. Put wireless clients behind a separate segment, and require VPN or zero-trust access to internal services. ## Timeline - 2026-10-27T08:25:09+00:00 analyst ## Documents - [describes] Broadcom WPS flaw leaves routers exposed to over-the-air takeover https://news.ycombinator.com/item?id=50255635 - [describes] WPSplinter: Broadcom WPS EAP fragment reassembly vulnerability https://qkaiser.github.io/broadcom-wps/ - [describes] One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/ --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_