Millions of Routers Are Endangered by Critical Broadcom Vulnerability

Ender Öztürk

October 27, 2026

A severe security vulnerability affecting millions of home routers has been identified by cybersecurity researcher Quentin Kaiser, who warns that the flaw has persisted since 2010. The security risk, which resides in the Broadcom router ecosystem, allows unauthorized attackers within Wi-Fi range to bypass authentication and gain control over vulnerable devices without requiring a password. This exploit, dubbed WPSplinter, targets the legacy WPS Monitor component responsible for managing Wi-Fi Protected Setup. Because this component exists in numerous hardware models globally, the potential attack surface remains dangerously large, exposing users to unauthorized network access and potential data theft.

WPSplinter Exploits Memory Without PIN Requirements

During the Hexacon security conference, Quentin Kaiser detailed how the WPSplinter exploit functions by manipulating how the router handles incoming WPS messages. When these messages arrive in fragmented segments, the device software fails to perform adequate boundary checks before reassembling them in memory. This technical oversight provides attackers with a pathway to inject commands directly into the router’s memory space. By exploiting this memory overflow, attackers can execute arbitrary code, which essentially grants them full control over the network traffic passing through the router.

Testing on specific hardware models, such as the Askey TCG3000 and the Sagemcom-manufactured Proximus BBOX3V+, confirmed that attackers could remotely extract Wi-Fi credentials and open command shells. The researcher emphasized that this attack is effective even at extended ranges, making it a significant threat to residential networks, particularly in regions like Belgium where many routers remain unpatched.

Broadcom Offers Limited Support for Legacy Systems

Broadcom has responded to these findings by asserting that the vulnerability was mitigated in 2018 through code revisions. However, the company has declined to assign a CVE identifier to the flaw, citing that the affected software components are no longer under official support. Kaiser argues that the 2018 patch was fundamentally incomplete and that many hardware vendors failed to integrate the update into their proprietary firmware.

The recommended fix involves transitioning from the proprietary WPS Monitor component to the open-source hostapd system. While this is a viable path for some Linux-based chipsets like the BCM3390 and BCM68xx series, it requires active intervention from manufacturers. Unfortunately, as many of these products have reached their end-of-life status, it is unlikely that users will receive the necessary firmware updates to secure their devices.

Users Must Assess Their Hardware Security Status

For those utilizing older eCos-based chipsets, there is effectively no way to eliminate the vulnerability. Users should be aware that simply changing their Wi-Fi password or disabling the WPS feature within the settings menu may not provide full protection, as the underlying vulnerable parser might remain active in the background. The most reliable course of action is to check the manufacturer’s support website for any available firmware patches or to consult with an internet service provider. In cases where the hardware is significantly outdated, replacing the router with a newer, supported model remains the only definitive way to mitigate these persistent security risks.

Given the ongoing security concerns surrounding legacy router hardware, we would like to hear from you. Have you checked your home network settings recently to verify that your router firmware is up to date, or are you considering an upgrade to protect your data? Please share your thoughts and experiences in the comments section below.