A 16-year-old vulnerability in Broadcom Wi-Fi software could allow attackers to take control of millions of routers without knowing their network passwords, according to research published by security researcher Quentin Kaiser.
The flaw affects Wi-Fi Protected Setup (WPS) software used across dozens of manufacturers and hundreds of products.ㅤ
Kaiser demonstrated unauthorized code execution on routers used by three major Belgian internet providers, including Proximus, Orange and VOO. He estimates approximately 1.56 million affected devices in Belgium alone.
The vulnerability allows attackers within Wi-Fi range to extract credentials or execute commands on affected equipment.
Broadcom acknowledged knowing about the issue since 2018 but declined to assign a CVE identifier, citing the software’s obsolete status. Although fixes exist for some platforms, Kaiser reported that the tested devices remained unpatched as of October 15. Older devices may require replacement.
Seemant Sehgal, Founder & CEO, BreachLock:
“This is not the first case of software being classified as obsolete but still deployed in millions of devices, and it will not be the last. The gap between what a vendor is responsible for maintaining and what still handles live traffic leaves real exposure.
“For ISPs, now is the time to review whether the devices they ship to customers have a documented end-of-support date, because the lack of one is how 1.5 million routers end up running vulnerable firmware with no path to a fix. For home users, the practical takeaway is that routers have a shorter useful security life than most people realize, and if yours came from your ISP more than a few years ago, it is probably running software that no one is responsible for keeping secure anymore.”
ㅤ
Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:
“The most consequential detail in Quentin Kaiser’s Broadcom Wi-Fi research is a paperwork decision. Broadcom has known since 2018 that its Wi-Fi Protected Setup (WPS) parsing code lets anyone in radio range execute commands on a router without knowing the network password. It confirmed a patch exists, then declined to assign a Common Vulnerabilities and Exposures (CVE) identifier because the software is obsolete. That software still runs on roughly 1.56 million gateways at Proximus, Orange and VOO in Belgium, and on gear from dozens of other vendors, including seven TP-Link models listed in Kaiser’s disclosure, from the Archer VR600 and VR900 at Türk Telekom to the VR1600 at Australian ISPs like Internode. Obsolete is doing a lot of work in Broadcom’s sentence.
“A CVE identifier is what turns a vulnerability into an operational fact. Without one, the flaw cannot enter the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog, Qualys and Tenable have nothing to write a detection rule against, and no procurement checkbox pressures an internet service provider (ISP) to act. CERT/CC closed Kaiser’s case the same day he filed it, because Broadcom is a CVE Numbering Authority and said no.
“I have yet to see a patching program with an answer for a vulnerability that has no CVE to scan for. Kaiser gave everyone 90 days, and as of October 15 every device he tested was still unpatched. Replacement, rather than patching, is the realistic fix for most of these fleets, and ISP hardware refresh cycles run on decades.”
This is why I turn off both WPS and Universal Plug and Play on every router that I install. Neither are safe and this report reinforces it.
Related
This entry was posted on October 20, 2026 at 4:00 pm and is filed under Commentary with tags Broadcom. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
16-year-old Broadcom Wi-Fi flaw exposes millions of routers
A 16-year-old vulnerability in Broadcom Wi-Fi software could allow attackers to take control of millions of routers without knowing their network passwords, according to research published by security researcher Quentin Kaiser.
The flaw affects Wi-Fi Protected Setup (WPS) software used across dozens of manufacturers and hundreds of products.ㅤ
Kaiser demonstrated unauthorized code execution on routers used by three major Belgian internet providers, including Proximus, Orange and VOO. He estimates approximately 1.56 million affected devices in Belgium alone.
The vulnerability allows attackers within Wi-Fi range to extract credentials or execute commands on affected equipment.
Broadcom acknowledged knowing about the issue since 2018 but declined to assign a CVE identifier, citing the software’s obsolete status. Although fixes exist for some platforms, Kaiser reported that the tested devices remained unpatched as of October 15. Older devices may require replacement.
Seemant Sehgal, Founder & CEO, BreachLock:
“This is not the first case of software being classified as obsolete but still deployed in millions of devices, and it will not be the last. The gap between what a vendor is responsible for maintaining and what still handles live traffic leaves real exposure.
“For ISPs, now is the time to review whether the devices they ship to customers have a documented end-of-support date, because the lack of one is how 1.5 million routers end up running vulnerable firmware with no path to a fix. For home users, the practical takeaway is that routers have a shorter useful security life than most people realize, and if yours came from your ISP more than a few years ago, it is probably running software that no one is responsible for keeping secure anymore.”
ㅤ
Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:
“The most consequential detail in Quentin Kaiser’s Broadcom Wi-Fi research is a paperwork decision. Broadcom has known since 2018 that its Wi-Fi Protected Setup (WPS) parsing code lets anyone in radio range execute commands on a router without knowing the network password. It confirmed a patch exists, then declined to assign a Common Vulnerabilities and Exposures (CVE) identifier because the software is obsolete. That software still runs on roughly 1.56 million gateways at Proximus, Orange and VOO in Belgium, and on gear from dozens of other vendors, including seven TP-Link models listed in Kaiser’s disclosure, from the Archer VR600 and VR900 at Türk Telekom to the VR1600 at Australian ISPs like Internode. Obsolete is doing a lot of work in Broadcom’s sentence.
“A CVE identifier is what turns a vulnerability into an operational fact. Without one, the flaw cannot enter the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog, Qualys and Tenable have nothing to write a detection rule against, and no procurement checkbox pressures an internet service provider (ISP) to act. CERT/CC closed Kaiser’s case the same day he filed it, because Broadcom is a CVE Numbering Authority and said no.
“I have yet to see a patching program with an answer for a vulnerability that has no CVE to scan for. Kaiser gave everyone 90 days, and as of October 15 every device he tested was still unpatched. Replacement, rather than patching, is the realistic fix for most of these fleets, and ISP hardware refresh cycles run on decades.”
This is why I turn off both WPS and Universal Plug and Play on every router that I install. Neither are safe and this report reinforces it.
Share this:
Like this:
Related
This entry was posted on October 20, 2026 at 4:00 pm and is filed under Commentary with tags Broadcom. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.