Why it matters: Chip manufacturers ship buggy code all the time, and that alone is not news. What sets WPSplinter apart is that Broadcom apparently issued a fix eight years ago, but that fix never reached the routers sitting in people’s homes. Additionally, the lack of a CVE left the problem invisible to the recommendations and patch pipelines that router manufacturers and ISPs rely on.
Security researcher Quentin Kaiser detailed the flaw at the Hexacon conference in Paris on October 16. He calls it WPSplinter, a name he only gave it because Broadcom refused to release an official identifier.
The flaw lies in the old Broadcom code for WPS, the feature that allows you to connect a device by pressing a button on the router instead of typing a password. This code mismanages the exchange of certain messages and, with the correct order, allows an attacker to read the router’s memory or execute external code on the device.
The attacker does not need the WLAN password or a completed WPS pairing. It is enough to be within radio range. This is also not the WPS PIN weakness that made headlines in the early 2010s. The problem is Broadcom’s code, not WPS itself.
Kaiser’s demos make the risk concrete. On an Orange Belgium Askey TCG3000 gateway, his exploit pulled the Wi-Fi key from the device’s NVRAM, sent it back over the air, and then used it to connect to the network. On another device, a Sagemcom Proximus BBOX3V+, he had a remote shell that ran entirely over WiFi, with no need for an internet connection on his side. He says the attack works over long distances.
A detail that won’t surprise anyone at this point… Kaiser says the AI helped him find the bug in less than a week, a job that would have taken months to do by hand. Previously, router firmware was partly protected by ambiguity and the tedious search. This is no longer the case for researchers or attacker.
Kaiser confirmed the error in gateways from three of the four major Belgian ISPs: Proximus, Orange and VOO. According to his count, there are around 1.5 million vulnerable devices in Belgium alone. But routers based on the same Broadcom chips are sold worldwide. His list of affected models, which he says is incomplete, includes devices from Cisco, TP-Link, Netgear, Sagemcom, Nokia, ZTE and Zyxel, used by ISPs such as Movistar, Optus, KPN and Türk Telekom. This number would put a more accurate global estimate in the low hundreds of millions.
When Kaiser reported the bug in July, Broadcom said it had known about it since 2018, had since replaced the old WPS code in its software and that it should contact the device manufacturers. Kaiser says the 2018 patch for the old code was incomplete anyway. Broadcom also declined to request a CVE, saying the code was outdated and no longer in its support window.
On Hacker News, some argue that the blame lies with the router manufacturers and ISPs for never updating. Kaiser’s counterpoint is that without CVE, the alert likely would never have made it into the supply chain.
Changing your WiFi password doesn’t help because the attack occurs before you log in. Turning off WPS is (always) worth it, but Kaiser warns that doing so may not completely disable the vulnerable code. If you have any doubts about your ISP’s router firmware, your best bet is to turn off the gateway’s WiFi, put it in bridge mode, and use your own current router. For anyone who wants to check their hardware, Kaiser has also published a detection script on GitHub.
One final detail that won’t surprise anyone at this point. Kaiser says AI tools helped him find the bug in less than a week, a job that would have taken months to do by hand. Previously, router firmware was partly protected by ambiguity and the tedious search. This is no longer the case, neither for researchers nor for attackers.
