Broadcom Wi-Fi WPSplinter Flaw Gives Root on Routers

The Broadcom Wi-Fi WPSplinter flaw is an unpatched buffer overflow and memory disclosure vulnerability in Broadcom's proprietary Wi-Fi Protected Setup (WPS) software that lets attackers within wireless radio range execute code as root or extract WPA2/WPA3 passwords on millions of routers without authentication [1], [4].

Imagine an attacker parked down the block who never touches your wide-area network interface, ignores your 20-character WPA2 password, and still opens an interactive root shell on your home or branch office gateway in seconds [1], [4]. On October 16, 2026, at the Hexacon security conference in Paris, ONEKEY lead security researcher Quentin Kaiser demonstrated exactly how the Broadcom Wi-Fi WPSplinter flaw makes that scenario possible across two distinct operating systems and multiple hardware architectures [1], [2]. Despite lingering in Broadcom's 802.11 software development kit (SDK) since at least 2010, the Broadcom Wi-Fi WPSplinter flaw carries no CVE identifier, has no deployed firmware fix across more than 1.56 million estimated gateways in Belgium alone, and exposes routers from dozens of global manufacturers [1], [3], [4].

How the Broadcom Wi-Fi WPSplinter Flaw Corrupts Router Memory Over the Air

The Broadcom Wi-Fi WPSplinter flaw resides in the parsing logic that reassembles fragmented Extensible Authentication Protocol (EAP) messages during a Wi-Fi Protected Setup (WPS) exchange [2], [4]. Because WPS is designed to let new devices join a wireless network before they possess the WPA2 or WPA3 Pre-Shared Key (PSK), the router's wireless driver accepts and processes 802.11 WPS management and EAPOL/EAP frames from any radio transmitter within range [2], [4]. No login, PIN entry, or physical button press on the router is required for the parser to handle initial fragmented EAP messages [4].

In Broadcom's 802.11 architecture, incoming wireless frames hit the physical and MAC layer handled by the Broadcom wl driver (wl.ko on Linux) and pass through the EAPD multiplexer daemon to the WPS state machine [2]. The Broadcom Wi-Fi WPSplinter flaw triggers inside this WPS daemon—named wps_monitor on Linux systems and running as the WPSM real-time task on eCos—when an attacker transmits multi-part EAP messages [2], [3]. Specifically, Kaiser's research titled "One Parser, Two Bugs, Many Routers" shows how a single faulty parser gives an attacker two distinct exploitation primitives [1], [2]:

1. Calibrated Out-of-Bounds Memory Read (Infoleak): By sending specially structured WPS frames, an attacker forces the Broadcom Wi-Fi WPSplinter flaw to leak memory contents back over the air via 802.11 responses [2], [4]. Kaiser used a calibration infoleak to find the relative address of the WPS state object, read self-referential pointers to calculate absolute memory addresses, and extract sensitive data directly from RAM—including the router's cleartext Wi-Fi PSK [2], [4].
2. EAP Fragment Reassembly Buffer Overflow: When reassembling multiple ~1,000-byte 802.11 EAP fragments (where the subsequent fragment offset +0x9 starts with a valid Wi-Fi Simple Configuration opcode between 0x04 and 0x0F), the parser fails to validate the cumulative length against the fixed destination buffer [2], [3]. The resulting buffer overflow corrupts adjacent memory structures inside the WPS state object [2], [4].

On MIPS and ARM routers, combining the memory leak with the buffer overflow lets the Broadcom Wi-Fi WPSplinter flaw bypass address space layout uncertainties and hijack control flow [2], [3]. On MIPS targets, for instance, the exploit overwrites pointers in the corrupted WPS structure to control the $a0 argument register passed to system($a0), executing arbitrary shell commands as root [2]. For security engineers accustomed to analyzing corrupt process memory, the mechanics resemble classic heap and buffer manipulation techniques covered in memory forensics and volatile memory inspection, except that here the entire exploit runs over raw 802.11 radio frames without touching a traditional TCP/IP socket [1], [2].

The diagram below illustrates how the Broadcom Wi-Fi WPSplinter flaw processes malicious 802.11 EAP fragments from an attacker's wireless adapter through the Broadcom driver stack to achieve unauthenticated root code execution [2], [4].

Demonstrated Impact: From Leaked Passwords to Root Shells Over 802.11 Frames

The Broadcom Wi-Fi WPSplinter flaw is not a theoretical compiler warning; Quentin Kaiser demonstrated working over-the-air exploits against two live ISP customer premises equipment (CPE) gateways deployed across Belgium [1], [5]. Both attacks ran without user interaction, without administrative credentials, and without knowing the wireless network password [4], [5]. Kaiser also emphasized that while his demonstration videos showed an antenna near the routers for laboratory filming, the Broadcom Wi-Fi WPSplinter flaw works over long distances anywhere within standard 802.11 radio reach [1], [5].

Against an Orange Belgium cable gateway—the Askey TCG3000 running the eCos real-time operating system—Kaiser used the Broadcom Wi-Fi WPSplinter flaw to execute custom shellcode that read the stored WPA2 pre-shared key out of the router's configuration memory, transmitted the password back over the wireless channel, and cleanly joined the target Wi-Fi network without crashing the device [1], [4]. Against a Proximus gateway—the Sagemcom-built BBOX3V+ (F@st) running Linux—Kaiser used the Broadcom Wi-Fi WPSplinter flaw to achieve unauthenticated remote code execution as root [1], [4]. Even more remarkably, Kaiser's payload spawned an interactive reverse shell carried entirely inside raw 802.11 wireless frames [1], [4].

Carrying the reverse shell over 802.11 frames means the Broadcom Wi-Fi WPSplinter flaw does not need an external command-and-control (C2) server on the internet [1], [4]. Outbound firewall rules, DNS sinkholes, and WAN intrusion detection sensors see nothing during initial compromise because the command channel travels strictly over the air between the router's radio and the attacker's wireless interface [1]. Once an intruder lands directly on the gateway via the Broadcom Wi-Fi WPSplinter flaw, perimeter defenses collapse unless defenders have already enforced strict internal network segmentation best practices to isolate wireless routers from core internal servers.

Which Routers, ISPs, and Broadcom SoCs Are Exposed to the WPSplinter Flaw?

The Broadcom Wi-Fi WPSplinter flaw affects dozens of hardware vendors, hundreds of router models, and millions of Broadcom-based access points worldwide [1], [3]. Using telecommunications data published by the Belgian Institute for Postal Services and Telecommunications (IBPT) alongside public ISP deployment figures, Kaiser estimated that more than 1.56 million gateways are exposed in Belgium alone across Proximus, VOO, and Orange Belgium, with Telenet devices also potentially impacted [1].

The table below details the confirmed Belgian ISP fleets and a representative sample of global router models verified as affected by the Broadcom Wi-Fi WPSplinter flaw in Kaiser's public detection repository [1], [3].

Hardware SoC Families Across eCos and Linux

The Broadcom Wi-Fi WPSplinter flaw spans both ARM and MIPS processor architectures because Broadcom reused the same proprietary C source code across its cable (DOCSIS), digital subscriber line (xDSL/vDSL2), and fiber (xPON) system-on-chip (SoC) SDKs [1], [2]. Even more challenging for defenders, several high-end gateways split workloads across heterogeneous dual-core SoCs—running eCos on one processor core and Linux on another—allowing an attacker who compromises the wireless parser to pivot across internal SoC interconnects [2].

The table below outlines the specific Broadcom SoC families and operating system configurations confirmed vulnerable to the Broadcom Wi-Fi WPSplinter flaw [1], [2].

Why a 16-Year-Old Bug Has No CVE and Remains Unpatched in 2026

The Broadcom Wi-Fi WPSplinter flaw reveals a systemic breakdown in how semiconductor SDK vulnerabilities trickle down to consumer and small-office routers [1], [4]. Introduced into Broadcom's wireless SDK around 2010, the vulnerable EAP fragment reassembly code was shipped to dozens of original equipment manufacturers (OEMs) who built their own router firmware around Broadcom's board support packages (such as the Broadcom 18.1 SDK release) [1], [2].

When Kaiser reported the Broadcom Wi-Fi WPSplinter flaw to Broadcom PSIRT on July 18 and July 27, 2026, Broadcom responded on July 28, 2026, stating that it had known about the vulnerability for a long time from prior external reports [1], [2]. According to Kaiser's findings, Broadcom released an insufficient patch in 2018 and subsequently deprecated its proprietary wps_monitor code in newer SDK releases in favor of the open-source hostapd and wpa_supplicant stack [1], [2]. However, migrating an existing router line to a newer SDK or replacing the wireless daemon requires heavy engineering effort that OEMs and ISPs rarely undertake for deployed hardware—and on eCos cable modems, migrating to Linux-based hostapd is architecturally impossible [1], [2].

Compounding the supply chain freeze, Broadcom refused on July 29, 2026, to assign a CVE identifier to the Broadcom Wi-Fi WPSplinter flaw or share the text of any prior customer portal notifications sent to OEMs [1], [4]. When Kaiser escalated the disclosure to the CERT Coordination Center (CERT/CC) via VINCE on August 4, 2026, CERT/CC closed the ticket the same day because Broadcom is a designated CVE Numbering Authority (CNA) with sole jurisdiction over its products [1], [4]. Without a CVE number, standard enterprise vulnerability management processes and automated CVSS 4.0 vulnerability triage workflows have no identifier to track, leaving OEMs and telecommunications providers completely in the dark unless they manually audit their binary firmware trees [1], [3].

The timeline below traces the 16-year history of the Broadcom Wi-Fi WPSplinter flaw from its SDK introduction to the 90-day disclosure deadline in October 2026 [1], [2].

Agentic Vulnerability Research and the Nearest-Neighbor Threat

One of the most consequential aspects of the Broadcom Wi-Fi WPSplinter flaw is how rapidly it was uncovered and weaponized in the lab [1], [2]. Rather than spending months manually reversing stripped eCos and Linux binaries, Kaiser connected an AI agent (running gpt-5.6-Sol under Trusted Access for Cyber approval) directly to a physical cable modem testbed via a USB-to-Serial UART console, an Alfa wireless adapter, a custom GDB stub, and a Model Context Protocol (MCP) Ghidra bridge (ghidra-rpc) [1], [2]. The agentic workflow rediscovered historical bugs (including Cable Haunt) and pinpointed the Broadcom Wi-Fi WPSplinter flaw across unfamiliar real-time operating system code in less than a week [1], [2].

As UnpanicTech recently examined in our analysis of autonomous AI attacks and offensive agent workflows, lowering the time required to reverse-engineer proprietary embedded firmware from several months to a few days changes the economics of hardware exploitation [1]. Legacy routers that previously survived through obscurity—because reversing monolithic eCos images was tedious—are now trivial targets for automated binary auditing [1], [2].

In practical operational terms, the Broadcom Wi-Fi WPSplinter flaw is tailor-made for what Kaiser highlights as nearest-neighbor attacks and hotel or branch-office network compromise [1]. An adversary does not need physical proximity to a target facility if they can compromise a vulnerable residential or small-business gateway across the street over the internet and then use that gateway's wireless radio to fire the Broadcom Wi-Fi WPSplinter flaw into an adjacent target's access point [1]. Because ISP routers lack endpoint detection agents, defenders have almost zero telemetry on the gateway itself, making a zero trust architecture implementation essential for protecting endpoints that connect through untrusted or ISP-managed wireless routers.

How to Test Your Router and Defend Against the Broadcom Wi-Fi WPSplinter Flaw

Because the Broadcom Wi-Fi WPSplinter flaw has no upstream patch deployed across major ISP fleets as of October 19, 2026, network administrators and home users cannot simply rely on an automatic overnight firmware update [1], [4]. Instead, defenders should verify whether their wireless gateways run the vulnerable Broadcom daemon and apply immediate configuration controls.

1. Fingerprint Live Access Points or Extracted Firmware

To help defenders and researchers measure the global exposure of the Broadcom Wi-Fi WPSplinter flaw, Kaiser published the open-source broadcom-wps detection toolkit on GitHub [3]. The toolkit provides two verification methods:

• Over-the-Air Dynamic Fingerprinting: Using a wireless network card in monitor mode, defenders can run Kaiser's Python fingerprinting script against their own access point [3]. The script checks for Broadcom proprietary Information Elements (IEs) alongside a protocol quirk that distinguishes Broadcom's vulnerable wps_monitor from patched hostapd builds—specifically, wps_monitor responds with an ACK where hostapd sends a NACK [3].
• Static Firmware YARA Scanning: Organizations with access to unpacked router firmware images can scan extracted binaries using the rules BRCM_WPS_Monitor_HAL_Config_ELF and VULN_BRCM_WPS_EAP_Fragment_Reassembly_ELF (`yara -w -r broadcom_wps_monitor.yar extracted_firmware_dir`) to identify the vulnerable ARM or MIPS fragment-reassembly opcode patterns [3].

2. Disable Wi-Fi Protected Setup (WPS) and Verify Over the Air

Because the Broadcom Wi-Fi WPSplinter flaw triggers inside the WPS EAP message reassembly path, disabling Wi-Fi Protected Setup (WPS) in the router's administrative interface is the primary immediate countermeasure [2], [3]. However, administrators should never blindly trust a web GUI checkbox on consumer or ISP-supplied routers: some embedded firmware builds merely hide the WPS PIN prompt in the web interface while leaving the underlying wps_monitor or WPSM daemon listening on the wireless interface [3]. After disabling WPS in the router settings, run the broadcom-wps fingerprinting script against the access point to confirm that the WPS listener is genuinely unresponsive [3].

3. Put Vulnerable ISP Gateways into Bridge Mode or Isolate Untrusted Wireless

If your internet service provider supplies a cable, DSL, or fiber gateway affected by the Broadcom Wi-Fi WPSplinter flaw and does not let you completely shut down the wps_monitor process, disable the ISP gateway's Wi-Fi radios entirely and place the modem into bridge mode. Handle wireless routing on a separate, actively maintained access point that uses a modern hostapd stack [2], [3]. Small businesses and remote executives using ISP routers should also fold wireless gateway controls into their formal small business cybersecurity policy so corporate traffic never relies on legacy ISP wireless encryption alone.

What Remains Uncertain About the Broadcom Wi-Fi WPSplinter Flaw

While the technical mechanics of the Broadcom Wi-Fi WPSplinter flaw are thoroughly documented through Kaiser's Hexacon presentation and live router exploits, several operational questions remain unresolved as of October 19, 2026 [1], [4]:

• True Global Device Count: The figure of 1.56 million vulnerable gateways covers only three Belgian operators (Proximus, VOO, and Orange Belgium), and Kaiser describes his worldwide estimate in the low hundred millions as a rough calculation pending official ISP disclosures [1], [4].
• ISP Remediation Timelines: Neither Proximus, Orange Belgium, nor VOO had deployed a patch to their subscriber fleets by the October 15, 2026 disclosure deadline, and it remains unclear which legacy models will receive backported binary fixes versus hardware replacement [1].
• Historical Exploitation in the Wild: Kaiser reported zero known real-world attacks abusing the Broadcom Wi-Fi WPSplinter flaw prior to his disclosure [4]. However, because Broadcom stated that other external entities had reported the bug in the past, and because eCos and embedded Linux routers rarely retain forensic crash logs across reboots, past covert use in targeted proximity operations cannot be ruled out [1], [2].

Sources & References

1. Quentin Kaiser (QTNKSR / ONEKEY), "One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux" (Published October 16, 2026) — https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/
2. Quentin Kaiser, "One Parser, Two Bugs, Many Routers — Hexacon 2026 Presentation Slides" (October 16–17, 2026) — https://quentinkaiser.be/assets/qkaiser-broadcom-wps-hexacon-2026.pdf
3. Quentin Kaiser, "GitHub Repository: qkaiser/broadcom-wps — Broadcom 802.11 SDK Detection Toolkit and Affected Devices List" (October 2026) — https://github.com/qkaiser/broadcom-wps
4. The Hacker News, "Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers" (Published October 19, 2026) — https://thehackernews.com/2026/10/unpatched-broadcom-wi-fi-flaw-lets.html
5. Security Affairs (Pierluigi Paganini), "16-Year-Old Broadcom Wi-Fi Bug Lets Attackers Take Over Routers Without a Password" (Published October 19, 2026) — https://securityaffairs.com/201268/iot/16-year-old-broadcom-wi-fi-bug-lets-attackers-take-over-routers-without-a-password.html