A vulnerability in Broadcom’s legacy Wi-Fi Protected Setup software can let an attacker within radio range reach a router before knowing the Wi-Fi password or completing WPS enrollment, according to research published on October 16 by Quentin Kaiser. Kaiser demonstrated information disclosure and arbitrary code execution on affected gateways, including devices supplied by Belgian internet providers.
What the research shows
The issue lies in the way Broadcom’s WPS Monitor reassembles fragmented EAP-WPS messages. Its parser does not adequately limit the assembled data to the destination buffer, according to the researcher’s public advisory. A nearby attacker can therefore interact with the vulnerable code over Wi-Fi without joining the network. The precise privileges and impact depend on the product and firmware.
Kaiser demonstrated the attack on an Orange Belgium Askey TCG3000, where his proof of concept retrieved the Wi-Fi key, and on a Proximus BBOX 3V+, where he obtained a shell. He also identified affected models in the VOO fleet. Those demonstrations establish the behavior on tested devices; they do not prove that every router with a Broadcom chipset is vulnerable.
The researcher’s device list includes products deployed beyond Belgium, including some associated with Movistar and Telefónica in Spain. It is incomplete, and hardware or firmware revisions within a named model can differ. Operators should confirm the exact build rather than treating a brand or chipset as a definitive test.
A patch supply-chain problem
Kaiser says the underlying code dates back to at least 2010. His disclosure timeline says Broadcom told him in July that a patch was available and advised him to contact manufacturers of affected devices. He reported that the Belgian gateways he had identified remained unpatched as of October 15. These are the researcher’s observations and vendor correspondence; the current status of every deployed device has not been independently established.
The public advisory says Broadcom moved away from the legacy WPS Monitor implementation toward hostapd on newer platforms. Older products may need an OEM or ISP firmware update, and some may have no practical migration path. There is no CVE identifier for this issue in the researcher’s advisory.
What owners can do
Organizations and households that manage an affected model should record its exact hardware and firmware version, then ask the manufacturer or ISP whether an update addresses this specific WPS Monitor flaw. Kaiser provides fingerprinting and firmware triage tools for technical teams, but their results still require device-specific confirmation.
Do not assume that switching off WPS in a router’s settings disables the vulnerable parser: the researcher explicitly warns that the toggle may not remove or fully deactivate it. If no fix is available, ask the supplier for a replacement or a documented mitigation. The central operational issue is the path from a component-level fix to the firmware actually installed in homes and businesses.