Broadcom WPS Flaw WPSplinter Leaves Millions of Routers Open With No CVE Assigned

Millions of home routers built around Broadcom chips carry a memory corruption bug in the chipmaker's proprietary Wi-Fi setup code that has survived at least sixteen years, one incomplete patch and a migration advisory that few manufacturers appear to have followed. The flaw lets an attacker within radio range run code as root on affected gateways without the network password and without any pairing step, which turns a device sitting in a hallway or a home office into an open door.

Quentin Kaiser disclosed the bug on October 16, 2026 at the Hexacon conference in Paris, where he demonstrated working exploits against home gateways from three Belgian internet providers. On an Orange Belgium ASKEY TCG3000 he pulled the pre-shared key out of the router's stored settings and sent it back over the air, then joined the network with it. On a Proximus BBOX3V+ built by Sagemcom he opened a reverse shell carried entirely in Wi-Fi frames, with no command server reachable over the internet.

The vulnerable component is Broadcom's own implementation of Wi-Fi Protected Setup, the convenience feature that lets a user join a network by pressing a button or typing a short PIN. Broadcom's code mishandles the reassembly of fragmented WPS setup messages, so crafted frames make the router combine more data than its memory can hold. The overwrite gives an attacker controlled information disclosure and arbitrary code execution, and none of it requires the network key.

The response has been as notable as the bug. No CVE identifier has been assigned, no public advisory has been published, and none of the affected devices Kaiser examined had been patched as of October 15, 2026. Broadcom has said it has known about the issue since 2018.

Key Facts

The Hacker News reported on October 19, 2026 that the flaw lets an attacker within radio range run code as root on Broadcom-based routers without the network password or any pairing step, and that no fix had been deployed. The report notes that the attack works at a distance rather than only up close, meaning a router inside a home can be reached from a neighboring building or a hotel room across the street.

Cybernews reported on October 19, 2026 that millions of routers may be exposed, including devices from Movistar, Cisco, TP-Link, Netgear, Nokia and ZTE. The outlet cited Kaiser's estimate of about 1.5 million affected gateways in Belgium: 850,000 at Proximus, 500,000 at VOO and 210,000 at Orange Belgium. Kaiser has described those numbers as napkin math, and the global total is unknown.

Security Affairs reported on October 19, 2026 that Kaiser reported the bugs to Broadcom in July 2026, that the company replied that a patch was available and told him to ask device manufacturers to contact Broadcom directly, and that it refused to assign a CVE or share the notification it sent through its customer portal.

Kaiser's own technical write-up, published on October 16, 2026, sets out the disclosure record in detail: reports to Broadcom's PSIRT on July 18 and July 27, 2026, a reply on July 28 stating that a patch was available, and a refusal on July 29 to register a CVE or share its OEM notification. CERT/CC opened a case on August 4, 2026 and closed it the same day, because Broadcom is itself a CVE Numbering Authority and declined to use that authority.

The affected silicon falls into two families. The older eCos-based parts (BCM3380, BCM3383, BCM33834) have no usable fix and amount to what Kaiser calls a permanent forever day. The newer Linux-based parts (BCM3390, BCM65xx, BCM68xx) could be repaired if manufacturers migrate their Wi-Fi software, which is what Broadcom recommended in 2018 when it shipped an incomplete patch and told customers to move to hostapd. In Belgium the flaw was exploitable on gateways from three of the four large providers: Proximus, Orange Belgium and VOO, whose affected fleet includes the Netgear CG3100, Netgear CG3700, Technicolor 7210 and CGA4233. Telenet may be affected through Sagemcom devices but that could not be confirmed.

Analysis

The disclosure fight matters more than the bug. Broadcom sits on the CVE Numbering Authority list, which means it can mint identifiers for flaws in its own products without asking anyone else. CERT/CC opened a case on August 4, 2026 and closed it the same day for exactly that reason: the coordination body had no lever to pull. What this really means is that a vendor can end a coordinated disclosure simply by declining to participate in it, and the record then shows a closed case rather than an unresolved vulnerability.

Kaiser's timeline makes the gap between knowing and acting concrete. Broadcom has acknowledged knowledge since 2018, shipped an incomplete patch that year, and told customers to migrate to hostapd. Eight years later, gateways built on eCos chips still carry the original parser, and Linux-based models still ship with the vendor's own Wi-Fi stack. The recommendation to migrate was sound engineering advice that nobody in the supply chain was obliged to follow.

The bigger picture here is that router security is dictated by the least responsive link in a chain that runs from chip designer to device maker to internet provider to household, and the household has no visibility into any of it. A subscriber to Proximus or Orange Belgium cannot audit the WPS parser in the box on the shelf, cannot tell whether the 2018 patch landed, and has no way to know that the identifier normally used to track a fix was never issued.

Severity, in practice, depends on the model. An attacker who reads the pre-shared key off an ASKEY TCG3000 gets the network password and everything that follows from it. An attacker who lands a reverse shell over 802.11 frames on a BBOX3V+ gets root without needing any internet-reachable command server, which makes the intrusion harder to spot from outside. Neither case requires a password, a pairing window or a user click. The eCos parts are the worst of it: no usable fix exists, so replacement is the practical answer.

Why It Matters

For the gateways counted in Kaiser's Belgian estimate of more than 1.5 million devices, the exposure is concrete rather than theoretical. A router that hands over its pre-shared key to anyone in range is no longer protecting the devices behind it, and a root shell delivered over Wi-Fi frames is difficult to detect from the network side because nothing has to traverse the internet first. The practical consequence is that a subscriber's security posture depends on hardware they did not choose and cannot inspect.

WPS has been treated for years as an optional convenience that cautious users can switch off. Kaiser's finding cuts against that assumption: he says disabling WPS may not eliminate the vulnerability, because the fault lives in the code that parses setup messages rather than in the feature's on and off switch. Advice that once counted as sufficient no longer maps onto the actual defect.

The supply chain reaches well beyond Belgium. Kaiser describes an issue affecting dozens of vendors, hundreds of products and millions of Broadcom-based access points worldwide. In Spain the affected devices include three older Movistar models made by Askey, MitraStar and Comtrend, and the ZTE f680 v4, distributed by MasMovil and by operators in Vietnam, Egypt and Moldova, is also on the list. None of those devices is sold with a label that tells a buyer which parser is inside.

Next Up

The near term question is whether manufacturers ship firmware for the Linux-based models, and whether anyone replaces the eCos gear that cannot be fixed at all. Kaiser's advice for hardware that will never be patched is replacement, which puts the decision in front of internet providers and their subscribers rather than in front of the chipmaker. Whether Proximus, Orange Belgium and VOO move on their own fleets, and whether Telenet confirms exposure through its Sagemcom devices, are the signals to watch.

Further out, the case is a test of whether a vendor that holds CVE assignment authority can decline to use it without any consequence. Broadcom has known about the bug since 2018 and has neither issued an advisory nor registered an identifier for it. Kaiser's use of OpenAI's Codex coding agent in GPT 5.6 mode to analyze firmware and build the exploits, which he says saved months, suggests the next round of disclosure will arrive faster than the last one and with far less patience for a closed case file.