Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers
A critical, unpatched flaw in Broadcom's Wi-Fi Protected Setup (WPS) software allows attackers within radio range to execute code as root on affected routers without needing a password.
Intelligence analysis by Gemini 2.5 Flash
Security researcher Quentin Kaiser disclosed a 'forever day' vulnerability in Broadcom's WPS, enabling remote root access on millions of routers. Despite the severity, no CVE has been assigned, and many devices, especially older eCos-based models, are unlikely to ever receive a patch, leaving them permanently exposed.
Imagine your home Wi-Fi router has a secret door that's supposed to help new devices connect easily. But a clever hacker found a trick with this door that lets them sneak in and take complete control of your router, even from a distance, without knowing your password. Many older routers can't even fix this door, meaning they'll always be vulnerable unless you replace them.
Analysis
Quentin Kaiser
Security researcher Quentin Kaiser brought to light a critical, unpatched vulnerability in Broadcom's Wi-Fi Protected Setup (WPS) software. On October 16, he publicly disclosed how an attacker within radio range could exploit this flaw to execute code as root on Broadcom-based routers, bypassing the need for network passwords or any prior pairing. Kaiser demonstrated the efficacy of his exploit against home gateways from three major Belgian internet providers, successfully extracting Wi-Fi passwords and establishing remote shells.
Kaiser's findings underscore a significant lapse in vendor responsibility and vulnerability management. Despite his efforts, no CVE identifier has been assigned to this flaw, and no patches have been deployed to the affected routers. This lack of official recognition and remediation leaves millions of devices globally exposed, highlighting a systemic issue in how such critical vulnerabilities are handled by manufacturers and coordination centers.
Broadcom's WPS
The core of the vulnerability lies within Broadcom's implementation of Wi-Fi Protected Setup (WPS), a feature designed to simplify device connection to Wi-Fi networks. Specifically, Broadcom's code mishandles the reassembly of fragmented WPS setup messages, creating a memory corruption vulnerability. An attacker can craft and send malicious messages to a vulnerable router, leading to memory corruption that can then be leveraged to read device memory or execute arbitrary code.
The affected Broadcom chips span two main families: older eCos-based models (BCM3380, BCM3383, BCM33834) and newer Linux-based models (BCM3390, BCM65xx, BCM68xx). While the Linux-based models theoretically could be patched if manufacturers updated their Wi-Fi software, the eCos-based models are deemed unfixable by Kaiser, leading to a permanent state of vulnerability. This distinction is crucial for understanding the long-term implications for device security.
Forever Day
Kaiser refers to the unpatchable nature of the flaw on older eCos-based Broadcom chips as a "forever day" bug, signifying that these devices will likely never receive a fix. This term highlights a dire situation where millions of legacy devices remain perpetually vulnerable to remote root code execution. The flaw itself is not new, with Kaiser tracing the problematic code back to at least 2010 and noting Broadcom's incomplete fix attempt in 2018, followed by a recommendation to switch to alternative Wi-Fi software like hostapd.
The absence of a CVE identifier further exacerbates the problem, as it prevents defenders and vendors from effectively tracking and addressing the vulnerability. Broadcom reportedly knew about the bug since 2018 but declined to register a CVE or make a public statement, which Kaiser believes contributed to the widespread lack of patching by device makers. For affected gear that cannot be fixed, the only practical option for users is replacement, a costly and often impractical solution for consumers and businesses alike. The potential for sophisticated attackers, such as state-sponsored groups, to leverage this flaw for nearby Wi-Fi breaches remains a significant concern.
Key points
- A flaw in Broadcom's Wi-Fi Protected Setup (WPS) allows attackers within radio range to run code as root on routers.
- The vulnerability exploits mishandling of fragmented WPS setup messages, leading to memory corruption.
- Security researcher Quentin Kaiser demonstrated the attack, extracting Wi-Fi passwords and opening remote shells.
- No CVE has been assigned, and Broadcom reportedly knew about the bug since 2018 but did not issue a public fix or CVE.
- Older eCos-based Broadcom chips are considered a 'forever day' vulnerability, meaning they will likely never be patched.
Millions of Broadcom-based routers, particularly older eCos models, will remain permanently vulnerable to remote root code execution due to the lack of a patch and Broadcom's refusal to assign a CVE. This creates a persistent attack surface for sophisticated adversaries, potentially leading to widespread network compromises and data theft for users unable or unwilling to replace their hardware.
