Ethical Hacking News
Millions of devices worldwide are vulnerable to a critical Wi-Fi flaw that allows attackers to gain access to routers and access points without any authentication. With no apparent fix in sight, device makers are urged to switch Wi-Fi software to patch this vulnerability, while users are left to navigate the risks of this perpetual "forever day" flaw.
A recent vulnerability in Broadcom's Wi-Fi Protected Setup (WPS) software has left millions of users vulnerable to attacks. The flaw was first discovered in 2010 and has been silently affecting Broadcom-based routers and access points for over a decade. The vulnerable chips fall into two families: older eCos-based models with no usable fix, and newer Linux-based models that could potentially be fixed with a software update. The lack of a patch and CVE identifier has led to concerns about the availability of a fix for these millions of devices. Attacks using this flaw could allow an attacker to send crafted messages that corrupt the router's memory, potentially allowing them to read Wi-Fi passwords or gain remote access. Millions of devices worldwide are affected, including routers and access points from dozens of vendors. The discovery highlights the importance of keeping software up-to-date and the need for manufacturers to prioritize the patching of vulnerabilities.
A recent vulnerability in Broadcom's Wi-Fi Protected Setup (WPS) software has left millions of users vulnerable to attacks, with no apparent fix in sight. According to security researcher Quentin Kaiser, the flaw was first discovered in 2010 and has been silently affecting Broadcom-based routers and access points for over a decade. The issue lies in the way Broadcom's code mishandles the reassembly of fragmented WPS setup messages, allowing an attacker within radio range to send crafted messages that corrupt the router's memory.
Kaiser's research revealed that the vulnerable chips fall into two families: older eCos-based models, such as the BCM3380, BCM3383, and BCM33834, where no usable fix was found, and newer Linux-based models, such as the BCM3390, BCM65xx, and BCM68xx, which could potentially be fixed if their makers switch Wi-Fi software. The Belgian per-provider counts for affected gateways, which Kaiser published, run into the hundreds of thousands, but are rough estimates.
The flaw was first tested against home gateways supplied by three Belgian internet providers: Proximus, Orange Belgium, and VOO. In one case, the attack read the Wi-Fi password off the device, while in another, it opened a remote shell over the air, without the need for any pairing steps or network passwords. Kaiser demonstrated the attack working against these devices, showcasing the potential for attackers to gain access to these routers without any authentication.
The lack of a patch and the absence of a CVE (Common Vulnerability and Exposure) identifier for this flaw have led to concerns about the availability of a fix for these millions of devices. Kaiser attributes this to Broadcom's decision to not deploy a fix for the older eCos-based models, labeling it a "forever day" due to the lack of a working patch. The fact that Broadcom has been aware of this issue since 2018 and has chosen not to register a CVE has led to many device makers never patching the vulnerability.
In light of this discovery, Kaiser has developed two tools to aid in the identification of affected devices: YARA rules that spot the vulnerable code in extracted firmware and a script that listens to a live access point and reports whether it looks vulnerable. These tools serve as a means for defenders to triage the situation, as a patched device can still match the rules, and a hit does not necessarily confirm the presence of the vulnerability.
Kaiser frames this vulnerability as well-suited to attackers who reach a target over nearby Wi-Fi rather than the internet, a technique Russian state hackers have used to breach networks from across the street. He notes that there have been no real-world attacks using this flaw, but the potential for this vulnerability to be exploited is high.
The widespread impact of this vulnerability is a serious concern, as millions of devices worldwide are affected, including routers and access points from dozens of vendors. It is essential for device makers to switch Wi-Fi software to fix this vulnerability, but until then, users are left vulnerable to attacks. Kaiser's discovery highlights the importance of keeping software up-to-date and the need for manufacturers to prioritize the patching of vulnerabilities.
Related Information:
https://www.ethicalhackingnews.com/articles/Unpatched-Broadcom-Wi-Fi-Flaw-Exposed-A-Perpetual-Forever-Day-for-Millions-of-Devices-ehn.shtml
https://thehackernews.com/2026/10/unpatched-broadcom-wi-fi-flaw-lets.html
https://securityaffairs.com/201268/iot/16-year-old-broadcom-wi-fi-bug-lets-attackers-take-over-routers-without-a-password.html
Published: Mon Oct 19 02:31:24 2026 by llama3.2 3B Q4_K_M
