Your router might be running code that nobody can patch, because researcher Quentin Kaiser just disclosed a flaw in Broadcom's Wi-Fi setup software that lets an attacker within radio range run code as root, without the network password, without a pairing step, and without anyone noticing, and on the older chips carrying this bug, no working fix was ever shipped, which makes it what the industry calls a forever day.

He disclosed it on October 16. No CVE has been assigned, and no fix has been deployed to the affected routers.

What Makes the Broadcom WPS Vulnerability So Serious

The attack doesn't need your password. It doesn't need a login. It doesn't need the attacker to be on your network.

It needs the attacker to be in radio range.

Kaiser demonstrated it against home gateways from three Belgian internet providers, and he demonstrated it end to end, not in a lab simulation.

How the Attack Actually Works

The flaw sits in Broadcom's version of Wi-Fi Protected Setup, the feature that lets a device join a Wi-Fi network without typing the password.

Broadcom's code mishandles the reassembly of fragmented WPS setup messages. That mishandling lets an attacker in range send crafted messages that corrupt the router's memory.

From that corruption, Kaiser built two capabilities. One reads memory back off the device. The other runs his own code on it.

Against the Orange Belgium Gateway

On the Askey TCG3000, the exploit read the Wi-Fi password, the PSK, directly from the router's stored settings.

It sent that password back over the air. Then it joined the network with it.

Read the key, get the network. Simple as that.

Against the Proximus Gateway

On the Sagemcom-built BBOX3V+, the exploit opened a reverse shell.

That shell was a remote command line carried over Wi-Fi frames, which meant no outside server was needed to receive the connection.

Both attacks ran without any login. Both worked at distance, not only up close, per Kaiser's account.

He reports no real-world attacks using the flaw. The working exploits are his own.

Which Broadcom Chips Are Affected

Broadcom's WPS code is embedded in routers and access points from dozens of vendors, and Kaiser estimates millions of devices worldwide are in scope.

The vulnerable chips split into two families, and the split is the whole story.

That table explains why this disclosure is landing so badly.

The newer Linux-based models could be fixed, in principle, if their makers moved to a different Wi-Fi software package. The older eCos chips can't be.

The Belgian Provider Findings

Kaiser found the flaw present and exploitable on gateways from three of Belgium's four major providers:

• Proximus
• Orange Belgium
• VOO

The fourth, Telenet, may be affected too, but he couldn't test one.

He estimates the Belgian per-provider counts run into the hundreds of thousands of gateways, though he describes those figures as rough.

Why a Wider Device List Needs Careful Reading

Kaiser published a broader list covering devices from Cisco small-business access points to Huawei and ARRIS routers.

That list mixes confirmed and unconfirmed entries. Some rest on an automated check that only flags a device as "likely vulnerable."

If your router appears there, that's a reason to look closer, not a confirmed verdict.

Why There's No Patch and No CVE

The flaw is old. Kaiser traces the code back to at least 2010.

Broadcom shipped an incomplete fix in 2018, then told customers to switch to a different Wi-Fi software package called hostapd rather than relying on that fix.

On the older eCos chips, he says, no working fix was ever shipped. That's the origin of the forever day label.

The CVE Gap

No CVE has been assigned, and that absence is itself the story.

Kaiser says Broadcom told him it has known about the bug since 2018 and had heard about it from others, but would not register a CVE or say anything publicly. He believes that silence is why so many device makers never patched.

When he took the case to the CERT Coordination Center, it closed the same day, because Broadcom holds the authority to assign CVEs for its own products and declined to do so.

The Hacker News found no CVE for the flaw as of October 19.

Sit with that arrangement for a moment. The entity that can issue the tracking identifier is the same entity that would rather not. Defenders downstream get no signal, and device makers get no pressure.

What Defenders Can Actually Do

There is no patch to install. Kaiser doesn't point to a setting that blocks the attack over the air either.

What he provides instead is a way to find affected gear.

YARA rules spot the vulnerable code in extracted firmware. Pull the firmware, run the rules, see what matches.

A listening script monitors a live access point and reports whether it looks vulnerable.

Both are triage aids, and Kaiser is explicit about that. A patched device can still match the rules, so a hit is a reason to check further, not a confirmed finding.

The Practical Options

• Replace gear that will never be fixed. For eCos-based devices, this is the only real answer, and it's unsatisfying.
• Inventory what you're running. You can't triage hardware you haven't catalogued. Model numbers and chip families matter here.
• Treat radio range as an attack surface. This is the shift most organizations haven't made. Physical proximity to your building is now a network boundary question.
• Watch for unexplained network joins. If someone gets the PSK this way, they're on your network with legitimate credentials. Nothing in your logs will look like a breach.
• Segment where you can. Guest networks and VLAN separation limit what a radio-range compromise reaches, even if they don't prevent it.

Why This Bug Suits a Specific Kind of Attacker

Kaiser frames the flaw as well suited to attackers who reach a target over nearby Wi-Fi rather than the internet.

That's not a theoretical concern. Russian state hackers have used this style of attack to breach networks from across the street.

The profile fits. No internet-facing service required, no phishing, no credentials. Park near the building, send crafted frames, and you're either reading memory or holding a shell.

For a target with strong perimeter defenses and a router nobody's updated since installation, radio range is the softest path in.

Why the Forever Day Label Matters Beyond This Bug

A forever day is a flaw that will never be patched on affected devices. The term exists because the situation keeps happening.

The pattern here is familiar. A vendor ships code into millions of devices, the code has a flaw, a partial fix goes out, and the remainder gets declared out of scope. Devices keep running because they work.

Security teams plan around patch cycles. Forever days break that planning entirely, because there is no cycle. The only remediation is replacement, and replacement only happens when someone decides the hardware is worth the cost.

That decision is easier to make when you know what you're running.

FAQ

What is the Broadcom WPS vulnerability?

It's a memory corruption flaw in Broadcom's implementation of Wi-Fi Protected Setup. An attacker within radio range can send crafted fragmented WPS messages that corrupt the router's memory, which can lead to root code execution without any password or login.

Is there a CVE for this Broadcom flaw?

No. Broadcom holds the authority to assign CVEs for its own products and declined to do so, and the CERT Coordination Center closed the case the same day. The Hacker News found no CVE as of October 19.

Which routers are affected?

Devices using Broadcom's vulnerable WPS code, across dozens of vendors. The older eCos-based chips (BCM3380, BCM3383, BCM33834) have no usable fix. Newer Linux-based chips (BCM3390, BCM65xx, BCM68xx) could be fixed if manufacturers switch Wi-Fi software.

Does the attacker need the Wi-Fi password?

No. That's the point. The attack runs without the network password and without any pairing step. Against one gateway, the exploit read the Wi-Fi password off the device and then used it to join the network.

How far away does an attacker need to be?

Within radio range. Kaiser says the attack works at distance, not only up close.

Is there anything I can do if my router can't be patched?

Kaiser published YARA rules for extracted firmware and a script that tests a live access point. Both are triage aids rather than confirmed findings. For gear that will never be fixed, replacement is the practical option.

Source: The Hacker News