{
  "id": 16666361,
  "title": "A 16-year-old bug could be putting millions of routers at risk — despite Broadcom saying it patched the issue years ago",
  "url": "https://urgent.news/2026/10/26/a-16-year-old-bug-could-be-putting-millions-of-routers-at-risk",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-26T22:05:00.000Z",
  "source": {
    "name": "TechRadar",
    "slug": "techradar",
    "url": "https://www.techradar.com/pro/security/a-16-year-old-bug-could-be-putting-millions-of-routers-at-risk-despite-broadcom-saying-it-patched-the-issue-years-ago"
  },
  "original_language": "en",
  "account": "A security researcher discovered a 16-year-old flaw in Broadcom's Wi-Fi software that allows attackers within Wi-Fi range to gain control of vulnerable routers without needing a password. The flaw, named WPSplinter, resides in Broadcom's legacy WPS Monitor, which handles Wi-Fi Protected Setup, a feature on many home routers. Normally, an attacker would need a password, pairing PIN, or button press to exploit this system. However, due to a coding error, an attacker can access this code over the air before a pairing is complete, allowing them to read the router's memory and execute arbitrary code.\n\nQuentin Kaiser, the researcher who discovered the flaw, presented it at the Hexacon event, where he detailed the issue. Despite Broadcom claiming to have patched the issue years ago, the fix did not reach many routers that need it. Broadcom has not assigned a CVE number to the flaw and has not issued a public advisory, making it unclear whether affected manufacturers have implemented the necessary updates.\n\nIn cases where firmware updates are not an option, such as with older eCos-based hardware, the only solution is to replace the router entirely. This flaw is particularly concerning because it can be exploited remotely from a significant distance, potentially allowing attackers to gain root access to routers across the street. This vulnerability has been present since at least 2010 and has been exploited by various attackers, highlighting the persistent nature of this issue despite Broadcom's assertions that the problem has been resolved.",
  "summary": "Broadcom says it fixed this 16-year-old Wi-Fi flaw in 2018, but the fix never reached the routers, and attackers in range need no password",
  "key_points": [
    "16-year-old Wi-Fi flaw discovered by Quentin Kaiser",
    "Attackers can gain router control without password",
    "Broadcom claims patching years ago, but flaw persists"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}