Glonce

Broadcom WiFi bug lets attackers run code on routers, researcher says

securityThe Glonce editorsHacker News🔥70Glonce rating70Impact72Novelty70Relevance75Surprise65Players40Credibility82

A security researcher has published the long-form version of a talk given at Hexacon in Paris on 16 October 2026. The subject is a vulnerability in Broadcom's proprietary implementation of 802.11 (WiFi) that, by the author's account, has been in Broadcom's SDK since at least 2010. The post does not state the author's name. The bug is described as a WPS EAP reassembly overflow.

According to the author, it can be triggered remotely over WiFi without knowing the network key and without completing a normal WPS enrollment. Exploitation gives controlled information disclosure and arbitrary code execution. The author says it affects dozens of vendors, hundreds of products and millions of Broadcom-based access points worldwide; that is the author's statement, not a measured count.

Broadcom released an incomplete patch silently in 2018 and then recommended that customers move to hostapd instead. The author concludes that this makes the bug a definitive "forever day" on eCos-based platforms (BCM3380, BCM3383, BCM33834) and a potential forever day on Linux platforms (BCM3390, BCM65xx, BCM68xx), unless the affected OEMs are willing to migrate.

The author demonstrated that the flaw is present and exploitable on 3 out of 4 Belgian internet service providers: Proximus (BBOX 3V+), VOO (Netgear CG3100, Netgear CG3700, Technicolor 7210, CGA4233) and Orange (ASKEY TCG3000). Telenet may be affected through Sagemcom F@st devices, but the author could not get one to test. As of 15 October 2026, none of these devices had been patched, which in the author's words means a root shell from across the street on a significant proportion of routers in Belgium, and probably elsewhere.

Two videos show the attacks. On an Orange Belgium ASKEY TCG3000, the exploit gains unauthenticated remote code execution; the shellcode reads the Wi-Fi pre-shared key from NVRAM and sends it back to the attacker over 802.11, and the author then joins the network with the leaked key to show the target stays stable and the key is correct. On a Proximus BBOX3V+ (also called Sagemcom F@st), the author uses the code execution to open a reverse shell over 802.11 frames, so no command-and-control server in the cloud is needed. The author notes that the antenna sits close to the router in the video, but says the attack works over long distances.

Broadcom's own response, as relayed by the author, was that it has known about the bug since 2018 and had received information about it from other external entities. Yet Broadcom refused to assign a CVE or to communicate publicly, which the author thinks is probably why so many OEMs did not patch.

The disclosure followed a strict 90-day policy. The clock started on 18 July 2026, when the author sent report KS-20260718-02 (BCM3380, BCM3383, BCM33834) to Broadcom PSIRT; a second report, KS-20260727-01 (BCM3390, BCM65xx, BCM68xx), followed on 27 July. On 28 July Broadcom replied that a patch was available and that the author should tell manufacturers of any affected devices to contact Broadcom. On 29 July Broadcom refused to register a CVE or to share the notification it had sent to OEMs through its Customer Portal. The same day the author sent a detailed report to Proximus through its CVD form (Proximus later asked for the full report and got it), tried to reach Orange Belgium and VOO, and sent the report and a toolkit to the Cyber Security Center Belgium so it could contact unresponsive ISPs. On 4 August a CERT/CC case opened through VINCE was closed the same day, because Broadcom is a CVE Numbering Authority and was unwilling to register a CVE. On 18 August the Orange Belgium CISO followed the author on LinkedIn, but there was still no answer from Orange. A follow-up call with a Proximus PSIRT analyst took place on 25 August. All parties were told the deadline was 16 October 2026.

The author explains the timeline choice: shorter would have been unfair to ISPs, even though the "vulnpocalypse" should push the field toward shorter deadlines; longer was ruled out because extended deadlines have been abused by vendors and ISPs and have led only to partial mitigation after 9 months or more. The author has no information about what vendors and ISPs have done since.

The author also offers a fingerprinting script and a YARA rule so others can help map the affected devices. Slides from the talk cover agentic vulnerability research, Broadcom's eCos and Linux-based 802.11 parsing, the bug itself, exploitation primitives, chaining, supply chain security and affected devices. A section of napkin math on affected device counts, done with a friend named Sol from IBPT data and ISP communications, comes with only "medium confidence" and no figures in the text.

Three takeaways close the post. First, "Security through Complexity is Dead": the author says the research would have taken months alone and took less than a week with AI frontier models, which makes it cheaper to probe deeper layers of infrastructure. Second, support window gaps are attacker opportunities: a bug introduced in 2010 and patched in 2018 is still in access points in ISP networks in 2026, a shelf life of 16 years. Third, tech debt will be collected, and bugs like this suit threat actors who favour nearest-neighbour attacks or hotel network compromise: highly targeted, over the air, against devices with very limited defender visibility.

Key facts

  • A WPS EAP reassembly overflow in Broadcom's proprietary 802.11 stack has been in its SDK since at least 2010, according to the researcher; an incomplete patch came silently in 2018.
  • It can be triggered over WiFi without the network key or a normal WPS enrollment, and gives arbitrary code execution; the author claims dozens of vendors, hundreds of products and millions of access points are affected.
  • The author showed it working on routers from 3 of 4 Belgian ISPs (Proximus, VOO, Orange); as of 15 October 2026 none of the affected devices had been patched.
  • Broadcom refused to assign a CVE or communicate publicly; a CERT/CC case via VINCE was closed the same day for that reason.
  • The author followed a 90-day disclosure period starting 18 July 2026 and says AI frontier models cut the research to under a week from an estimated months.

Why it matters

The flaw is reachable over the air by someone nearby, needs no network key, and ends in code execution on the router. The author says it has lived in Broadcom's SDK since at least 2010, was only partly patched in 2018, and remains in deployed ISP devices in 2026. The missing CVE is part of the story: the author thinks Broadcom's refusal to assign one or speak publicly is probably why so many OEMs did not patch. The post also makes a process point: the author says AI frontier models turned months of work into under a week.

Who it affects

Per the author, dozens of vendors, hundreds of products and millions of Broadcom-based access points worldwide. The named platforms are BCM3380, BCM3383 and BCM33834 (eCos) and BCM3390, BCM65xx and BCM68xx (Linux). In Belgium the author demonstrated it on Proximus (BBOX 3V+), VOO (Netgear CG3100, Netgear CG3700, Technicolor 7210, CGA4233) and Orange (ASKEY TCG3000). Telenet may be affected through Sagemcom F@st devices, but the author could not test one. The author says affected manufacturers serve a larger market, so it is not limited to Belgium.

How to use it

The post offers a fingerprinting script and a YARA rule so others can help identify affected vendors and devices and document the blast radius. Slides from the Hexacon talk are linked for the technical detail on the bug, exploitation primitives and chaining. Manufacturers who find affected devices are, per Broadcom's reply to the author, supposed to contact Broadcom. The post gives no patch instructions for end users.

How solid is it

This is a first-person research write-up with two demo videos, one on an Orange Belgium router and one on a Proximus router, plus a dated disclosure timeline. The claims about scale (millions of devices, dozens of vendors) are the author's statement, and the author calls the supporting napkin math medium confidence. The text gives no numeric estimate of affected devices. The statements about Broadcom's position, including that it has known since 2018, are relayed by the author. The post does not include statements from Proximus, Orange Belgium, VOO, Telenet or any OEM beyond the author's own timeline entries. It does not say the exploit has been used in the wild.

Risks and caveats

The author says the attack works over long distances, though no range in metres or kilometres is given. The author has no information on measures taken by vendors and ISPs; all he or she knows is that the devices were still unpatched on 15 October 2026. The post does not say whether Broadcom's patched SDK fully fixes the bug; it calls the 2018 patch incomplete. The "forever day" label for Linux platforms is conditional: a potential forever day unless OEMs are willing to migrate. The post itself says such bugs suit targeted attacks such as nearest-neighbour or hotel network compromise, against devices defenders can barely see.

“Security through Complexity is Dead.”

— The researcher, in the post on quentinkaiser.be