WPSplinter: Attack on Selected Broadcom Wi‑Fi Routers from Radio Range
Researcher Quentin Kaiser published details of a flaw in Broadcom’s 802.11/WPS implementation. According to his tests, an attacker within Wi‑Fi range does not need the network password or completed WPS pairing.
Security researcher Quentin Kaiser published technical details on October 16 of an attack identified as WPSplinter Broadcom Wi‑Fi. The flaw affects Broadcom’s proprietary implementation of the 802.11 and WPS standards. According to the researcher, an attacker within radio range of a wireless network can trigger a memory leak and subsequently execute arbitrary code without knowing the Wi‑Fi password or completing WPS pairing.
This is a local wireless attack: the attacker must be within range of the target router’s signal. However, they do not need to be logged into the network. If successfully exploited, the flaw could allow control of the affected gateway, which often forms the boundary of a home or corporate network.
WPSplinter Broadcom Wi‑Fi in the Researcher’s Tests
Kaiser demonstrated unauthenticated remote code execution on specific gateways used by Belgian operators Proximus, VOO, and Orange Belgium. In two demonstrations, he obtained a root shell—access with the highest privileges on the device—or the Wi‑Fi PSK, the wireless network’s pre-shared key.
The researcher states that as of October 15, 2026, the devices he tested had not been patched. According to his published information, Broadcom did not assign the flaw a CVE identifier. No public statement from Broadcom regarding the case was found.
Kaiser’s technical description points to a problem in a parser related to WPS. The vulnerability is said to affect selected routers using Broadcom Wi‑Fi, including older eCos platforms and Linux-based devices. On older eCos platforms, practical remediation may be limited or unavailable.
What Taking Over a Router Means
A router handles traffic between the local network and the internet and may contain data needed to connect to or manage the network. Taking over such a device could allow an attacker to manipulate network traffic or access data stored on the gateway. The specific consequences depend on the device’s configuration and features.
The researcher estimates that a large number of devices may be affected, also referring to millions of routers. However, this scope is not an independently verified inventory. The list of models in the published repository is also incomplete; for some devices, it indicates probable exposure rather than direct confirmation of vulnerability through testing.
Fingerprinting Is Not Confirmation of the Flaw
Alongside the technical description, Kaiser published a device-fingerprinting tool and YARA rules. They are intended to help administrators and manufacturers with initial triage—in other words, identifying potentially affected routers. However, a positive result alone does not definitively confirm that a specific device is vulnerable.
For users of routers supplied by operators, the important point is that firmware updates are generally provided by the operator or device manufacturer. The actual patch status for models used by Proximus, VOO, and Orange Belgium has not yet been confirmed in the available materials. There is also no confirmed information about the flaw being exploited in the wild.
What to Expect Next
Further developments may bring a security advisory or CVE from Broadcom, confirmed firmware updates from manufacturers and operators, and independent verification of the list of affected models. Statements from Proximus, VOO, and Orange Belgium about the patch status of the devices on which the researcher demonstrated the attack will also be important.
Sources
- Quentin Kaiser — One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux – Primary technical description, publication date, demonstrations on specific devices, patch status, and limitations of the estimates.
- qkaiser/broadcom-wps – The existence of the fingerprinting tool and YARA rules, their limitations, and the list of tested or identified devices.
- The Hacker News – Independent coverage of Kaiser’s findings, including the local nature of the attack and the absence of confirmed exploitation in practice.
Verified and updated: October 19, 2026 15:23
