Broadcom Wi-Fi bug turns sweet 16, still lets strangers hijack your router
Chip giant knew about the flaw in 2018, researcher claims, but millions of devices may still be vulnerable
A 16-year-old security flaw in Broadcom's Wi-Fi software, known as WPSplinter, has been disclosed by researcher Quentin Kaiser. This vulnerability, which dates back to at least 2010, allows attackers to hijack millions of routers without needing the network password. The flaw lies in Broadcom's handling of Wi-Fi Protected Setup (WPS), a feature that simplifies device connection to wireless networks without manually entering a password.
By sending specially crafted WPS messages, attackers can corrupt the router's memory, enabling them to run their own code on the device. This is possible even without the Wi-Fi password, and the router's owner does not need to take any action. Kaiser demonstrated working exploits against routers from Belgian providers Proximus, Orange, and VOO.
He estimates that around 850,000 Proximus gateways, 500,000 VOO gateways, and 210,000 Orange gateways could be affected, totaling 1.56 million routers in Belgium. However, the issue is likely to extend beyond Belgium, as Broadcom's Wi-Fi technology is used by numerous manufacturers worldwide. Broadcom knew about the vulnerability since 2018 and released a partial fix without publicly disclosing it.
The company advised manufacturers to move away from Broadcom's proprietary implementation and use open-source software instead. Routers with specific Broadcom chips, like BCM3380, BCM3383, and BCM33834, are particularly vulnerable, and Kaiser calls the flaw a "forever day," suggesting it may never be fixed.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
