Broadcom SDK Wi-Fi Bug Lets Attackers Run Code on Routers Without Passwords or WPS Credentials
A vulnerability in Broadcom’s 802.11 implementation allows attackers to execute code on routers without credentials, posing a persistent risk to unpatched devices.
Key points
- The flaw exists in Broadcom’s proprietary 802.11 SDK code dating back to at least 2010.
- Attackers can achieve remote code execution without knowing the Wi-Fi password or using WPS.
- No patches were confirmed for affected Belgian devices as of October 15, 2026.
Broadcom’s proprietary 802.11 implementation contains a vulnerability that permits unauthenticated remote code execution on consumer routers. Researcher Quentin Kaiser documented this flaw at Hexacon in Paris, noting it has resided in the vendor’s software development kit since at least 2010. The issue affects devices using specific Broadcom chipsets, exposing them to takeover by attackers within wireless range who do not possess network credentials.
Root cause
The vulnerability stems from incomplete handling in the Wi-Fi Protected Setup (WPS) Extensible Authentication Protocol reassembly code. According to Kaiser, an incomplete patch was released in 2018, but Broadcom subsequently recommended migrating to hostapd. This legacy code path remains a definitive risk on eCos-based platforms and a potential risk on Linux platforms unless manufacturers perform the migration.
Attack path
An attacker within Wi-Fi range can trigger the flaw without knowing the network key or completing normal WPS enrollment. Kaiser demonstrated extracting the Wi-Fi password from router memory and transmitting it wirelessly. The attacker then used the stolen credential to connect to the network. This process requires no user interaction and can be executed remotely using only Wi-Fi frames.
Affected versions
The vulnerability impacts routers built with specific Broadcom chipsets. Affected hardware includes eCos-based platforms such as BCM3380, BCM3383, and BCM33834. Linux-based platforms including BCM3390, BCM65xx, and BCM68xx are also potentially affected. Devices confirmed vulnerable in demonstrations include the Orange Belgium ASKEY TCG3000 and the Proximus Sagemcom F@st/BBOX3V+.
Mitigation
- Monitor for unofficial patches from original equipment manufacturers.
- Evaluate migrating firmware to use hostapd instead of the proprietary implementation.
- Restrict physical access to networks using vulnerable Broadcom chipsets.
- Audit router configurations for unnecessary WPS functionality.
Detection notes
Security teams should monitor for anomalous Wi-Fi association attempts that bypass standard authentication flows. Look for unexpected memory access patterns or data exfiltration from router management interfaces. Check logs for reverse shell connections initiated from internal network segments. Investigate any sudden changes in Wi-Fi configuration or credential storage. Alert on traffic originating from devices that should not have network access privileges.
Background: Data exfiltration
Data exfiltration prevention requires monitoring outbound traffic for anomalies, restricting user permissions through strict access controls, and encrypting sensitive files at rest. You must detect unusual data movement patterns early, block unauthorized transfer methods, and verify that backup systems remain intact to limit exposure during a breach.
Read the full guide: Data Exfiltration Prevention: Stop Hidden Data Theft Before It Escapes
What to do and how to stay safe: Broadcom
- Review your router model against lists of devices using Broadcom BCM3380, BCM3383, BCM33834, BCM3390, BCM65xx, or BCM68xx chipsets.
- Disable Wi-Fi Protected Setup (WPS) in your router’s administrative interface if it is currently enabled.
- Change your Wi-Fi password to a strong, unique passphrase to limit the impact of credential theft.
- Contact your internet service provider or device manufacturer to inquire about firmware updates that address legacy SDK vulnerabilities.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this vulnerability require the attacker to know the Wi-Fi password?
No, the attacker can execute code and extract the password without prior knowledge of the network key.
Is there a confirmed patch for all affected devices?
No, as of October 15, 2026, none of the affected devices in Belgium had received a patch.
Which specific routers were shown to be vulnerable in demonstrations?
The Orange Belgium ASKEY TCG3000 and the Proximus Sagemcom F@st/BBOX3V+ were demonstrated as vulnerable.
