Broadcom Wi-Fi flaw lets nearby attackers seize routers without passwords

Quentin Kaiser revealed two critical bugs in Broadcom's Wi-Fi stack, collectively called "WPSplinter," that have existed since at least 2010 and allow memory corruption through specially crafted WPS packets. This enables an attacker within Wi-Fi range to run arbitrary code on vulnerable routers and extract the Wi-Fi password without any user action. Kaiser demonstrated the exploit on devices supplied by Proximus, Orange, and VOO, including extracting credentials from an ASKEY TCG3000 gateway.

He estimates that millions of routers worldwide could be affected, given Broadcom's broad use across manufacturers. The chipmaker was aware of the vulnerability in 2018 and released a partial patch while recommending a move to the open-source hostapd implementation. Older eCos-based Broadcom chips may never receive a full fix, leaving many routers without a clear remediation path.