Unpatched Broadcom Wi-Fi Flaw Hands Nearby Attackers Root on Routers

On October 16, security researcher Quentin Kaiser disclosed a vulnerability in Broadcom's Wi-Fi setup software. The flaw lets an attacker within radio range run code as root on Broadcom-based routers, without the network password and without any pairing step.

The bug lives in Broadcom's version of Wi-Fi Protected Setup (WPS), the feature that lets a device join a network without typing the password. Broadcom's code mishandles the reassembly of fragmented WPS messages, so crafted packets corrupt the router's memory. From there Kaiser built two things: a way to read memory back off the device, and a way to run his own code on it.

What the demo showed

Kaiser demonstrated the attack against home gateways from three Belgian providers. On the Askey TCG3000 shipped by Orange Belgium, the exploit read the stored Wi-Fi password (the PSK), sent it back over the air, and joined the network. On Proximus's Sagemcom-built BBOX3V+, it opened a reverse shell — a remote command line carried over Wi-Fi frames, so no outside server was needed. Both worked without any login and, Kaiser says, at a distance, not only up close. He reports no real-world attacks; the working exploits are his own.

What's affected

Broadcom's WPS code is embedded in routers and access points from dozens of vendors, and Kaiser estimates millions of devices are affected worldwide. The vulnerable chips split into two families. Older eCos-based models (the BCM3380, BCM3383 and BCM33834) have no usable fix — he calls the bug a permanent "forever day" on those devices. Newer Linux-based models (the BCM3390, BCM65xx and BCM68xx) could be fixed if their makers switch Wi-Fi software.

In Belgium the flaw was confirmed and exploitable on gateways from three of the four big providers — Proximus, Orange Belgium and VOO; a fourth, Telenet, could not be tested. A wider list, ranging from Cisco small-business access points to Huawei and ARRIS routers, mixes confirmed and unconfirmed entries.

Why there's no patch, and no CVE

The code is old — Kaiser traces it back to at least 2010. Broadcom shipped an incomplete fix in 2018, then told customers to switch to a different Wi-Fi package, hostapd, rather than rely on the fix. No CVE has been assigned. Kaiser says Broadcom has known about the bug since 2018 but will not discuss it publicly or register a CVE — which he believes is why so many device makers never patched. His report to the CERT Coordination Center was closed the same day: Broadcom itself holds the authority to assign CVEs for its own products.

What defenders can do

There is nothing to install and no setting Kaiser points to that blocks the attack over the air. Instead he offers detection aids: YARA rules that spot the vulnerable code in extracted firmware, and a script that listens to a live access point and reports whether it looks vulnerable. Both are triage tools — a match is a reason to look closer, not a confirmed finding. For gear that will never be fixed, replacement is the practical option.

Source: The Hacker News