A memory-corruption weakness present in Broadcom Wi-Fi software for roughly 16 years can let a nearby attacker compromise certain routers without first knowing the wireless password. The research focuses on a proprietary implementation of Wi-Fi Protected Setup, or WPS, that has remained embedded in deployed gateways long after replacement software became available.

Security researcher Quentin Kaiser disclosed the work at the Hexacon conference in Paris on October 16, 2026. His tests show that the vulnerable processing happens before ordinary WPS enrollment completes. That distinction matters: a strong network key does not stop an attacker from reaching the faulty code over the air.

How crafted wireless messages reach router memory

The weakness lies in code that reassembles fragmented Extensible Authentication Protocol messages used during WPS exchanges. Insufficient length validation allows specially constructed wireless traffic to overflow a memory buffer. An attacker within radio range can use the resulting memory access to leak or alter data and redirect program execution.

This is not a technique for guessing or mathematically breaking a Wi-Fi password. It attacks the router’s message handling before authentication has been completed. Physical proximity remains necessary, but “nearby” access can sometimes be provided indirectly by another compromised device in range, making the boundary less reassuring than it may sound.

Kaiser demonstrated two concrete outcomes. Against an Orange Belgium ASKEY TCG3000, he extracted the stored wireless password, returned it through Wi-Fi frames and then joined the network normally. Against a Proximus BBOX3V+, he obtained a remote command shell carried over wireless frames, without relying on an external cloud command-and-control server.

Known devices and uncertain global scope

The research confirmed exploitation on equipment supplied by three Belgian internet providers. Tested models included the Proximus BBOX3V+, VOO Netgear CG3100 and CG3700, Technicolor TC7210 and CGA4233, and Orange ASKEY TCG3000. Possible exposure in Telenet equipment has not been confirmed.

Kaiser estimates that roughly 1.56 million gateways across Proximus, legacy VOO and Orange could be involved. That number is a research estimate rather than a verified total from the providers. The same legacy Broadcom code may appear in millions of access points globally, but the complete device list and actual vulnerable population remain unknown.

The vulnerability should also be kept separate from Kr00k, an earlier Broadcom-related wireless issue. This research concerns fragmented WPS message handling and requires its own device-level assessment.

An incomplete migration problem

Kaiser characterizes a 2018 fix as incomplete. Correspondence included in his presentation says Broadcom had known about the issue for years and offered replacement software based on hostapd and WPA Supplicant beginning in 2018. Moving products away from the proprietary implementation, however, depended on device manufacturers and service providers.

The researcher reported the eCos variant on July 18 and the Linux variant on July 27. According to his account, Broadcom declined to issue a CVE, while the Belgian devices tested remained unpatched as of October 15. He released a wireless fingerprinting script and YARA rules for firmware screening, but these tools provide leads rather than definitive proof that a particular device is exploitable.

What network owners can do

Consumers often cannot replace embedded router components themselves. They should check their provider’s notices and firmware version, enable automatic updates where available, and ask whether their model uses the affected Broadcom WPS implementation. Disabling WPS may reduce exposure, but owners should seek model-specific guidance rather than assume a user-interface switch removes all vulnerable code paths.

Enterprises should identify provider-managed gateways and access points, request written remediation status, and monitor the internal network for unexpected devices or configuration changes. Where no supported fix exists, replacing the gateway may be the only dependable long-term answer. The larger lesson is that old networking code can remain reachable below the password boundary for years, turning software supply-chain age into an immediate local attack surface.