The demonstration took place on a stage in Paris, against a home gateway in the room, and it began with a laptop that did not know the Wi-Fi password. Within a few minutes the researcher had read the password out of the device’s memory over the air, joined the network with it, and, on a second router, opened a command shell carried inside Wi-Fi frames. No login, no pairing step, no cable.
Quentin Kaiser disclosed the flaw at the Hexacon conference on October 16 and published a long technical account the same day. The bug is in Broadcom’s implementation of Wi-Fi Protected Setup, the feature known as WPS that exists to let a printer or a phone join a network without anyone typing a passphrase. It is not Adobe’s image editing software that shares the abbreviation, and the two have nothing in common beyond three letters.
WPS works by exchanging a short sequence of setup messages, and those messages can be fragmented at the link layer. Broadcom’s code reassembles the fragments without checking that the total length fits the buffer it is writing into, which lets an attacker in radio range corrupt memory on the device. Kaiser built two capabilities from that corruption: a controlled way to read memory back off the router, and a way to execute his own code with the privileges of the process that parses the frames, which on these systems is root.
The two demonstrations show what those primitives are worth. Against an Askey TCG3000 supplied by Orange Belgium, his code read the pre-shared key out of the router’s stored configuration, transmitted it back over 802.11, and then associated with the network using it, which proved the key was correct and the device still stable. Against a Sagemcom-built BBOX3V+ supplied by Proximus, the exploit gave him a reverse shell delivered entirely in Wi-Fi frames, so no server on the internet was involved and nothing had to call home.
Range is the part that gets underestimated. Kaiser noted that the antenna in his video was close to the target for the camera’s benefit and that the attack works at distance. That is the profile of a nearest-neighbor intrusion, the technique security researchers have documented in campaigns where an attacker works from a van outside a building, or from the room next door in a hotel. The device does not need to be exposed to the internet. It needs to be within radio reach of someone who wants in.
The affected population is defined by a chip, not a brand. Broadcom’s Wi-Fi software is embedded in access points and routers sold by dozens of manufacturers, which puts the number of devices in the millions. Kaiser separates them into two families. The older eCos-based chips, the BCM3380, BCM3383 and BCM33834, have no usable fix and he calls the bug a permanent one for those platforms. The newer Linux-based chips, the BCM3390, BCM65xx and BCM68xx, can be fixed if the manufacturer replaces Broadcom’s Wi-Fi stack with the open-source hostapd.
The disclosure history explains why so little has happened. Kaiser sent his report to Broadcom on July 18 and a second one covering the Linux chips on July 27, on a 90-day clock that expired on October 16. Broadcom replied that a patch was available and that he should ask device makers to contact the company. Broadcom’s position, as he describes it, is that it has known about the flaw since 2018, shipped an incomplete fix that year, and told customers to migrate to hostapd instead.
The absence of a CVE is not a bureaucratic detail. Vulnerability scanners key on identifiers, procurement contracts require them, and security teams triage by them. A flaw with no identifier and no vendor advisory is a flaw that most organizations cannot put in a ticket, which is a large part of why the routers in Kaiser’s tests were still unpatched eight days before he spoke.
There is one disagreement in the public record worth flagging. Kaiser says he has seen no evidence of the flaw being used in real attacks and that the working exploits are his own. The threat intelligence firm Rescana has issued an alert describing exploitation in the wild. Both statements can be true if the activity Rescana observed is unrelated, and neither company nor researcher has published the evidence that would settle it. Prudence argues for treating the flaw as exploited.
What defenders can do is limited in an unusual way. There is no patch to install on the older chips, and Kaiser does not point to a setting that blocks the attack over the air, because the vulnerable code parses frames before any enrollment completes. Turning WPS off in a router’s administration page does not necessarily remove the handler. What he published instead is a set of YARA rules for spotting the vulnerable code in extracted firmware and a script that listens to a live access point and reports whether it looks susceptible, with the caveat that a patched device can still match and a hit is a reason to look further rather than a finding.
For equipment that will never be fixed, replacement is the remedy, and that is a strange sentence to write about hardware that works perfectly well. The bug has been in the code since at least 2010, survived a partial patch in 2018, and is now shipping in devices sold by internet providers who control the firmware and set the replacement cycle. Sixteen years is longer than the support life of most of the products that contain it, which means the flaw will outlive the warranty, the ISP’s upgrade schedule, and probably the customer’s patience.
