A Broadcom Wi-Fi flaw lets hackers take over internet routers from the street

On October 16, in Paris, security researcher Quentin Kaiser gave an unusual demonstration at the Hexacon conference. He took control of internet routers from Belgian operators without knowing their Wi-Fi password. All he needed was to be within radio range.

The flaw, which he named WPSplinter, sits in the Wi-Fi code that Broadcom supplies to router and gateway manufacturers. According to the researcher, it has been there since at least 2010. Broadcom refused to assign it a CVE identifier, the reference number security teams use to track a vulnerability. As of October 15, none of the affected devices in Belgium had received a patch, according to Techzine.

How a simple Wi-Fi signal opens the router

It all starts with WPS (Wi-Fi Protected Setup), the feature that pairs a device at the press of a button. At Broadcom, it is handled by a legacy component, WPS Monitor. It reassembles the message fragments it receives incorrectly: it does not check that they fit in the memory allocated. And this code can be reached before any authentication. The researcher says he used this to get a controlled memory leak and code execution on the device.

He gave two demonstrations. On an Askey TCG3000 router from Orange Belgium, his code extracted the Wi-Fi key from memory and sent it back to him over the air. He was then able to join the network. On a Proximus BBOX3V+, he obtained remote access to the system using only Wi-Fi frames. “From across the street, you can get root access on a significant share of routers in Belgium, and probably elsewhere too,” he writes, as quoted by Techzine. He also says he found the flaw in less than a week using cutting-edge AI models, instead of several months, as with the Linux flaw attributed to a Tencent AI.

How many routers are affected?

The researcher relies on data from the Belgian telecoms regulator for an estimate that he himself calls approximate. He counts about 850,000 routers at Proximus, 500,000 at VOO and 210,000 at Orange Belgium, for a total of more than 1.5 million. Elsewhere, the scale is unknown.

His reference page lists several families of Broadcom chips (BCM3380, BCM3383, BCM33834, BCM3390, BCM63xx, BCM65xx, BCM68xx). It also cites dozens of models from TP-Link, Netgear, Nokia, Sagemcom, ZTE, Zyxel and Cisco. The operators mentioned include KPN, Movistar, O2 and SFR. Neuf NB6 boxes are also listed, with an assessment “in progress.” The researcher warns that this community-maintained list is incomplete. An affected chip also does not prove that a given firmware version is vulnerable. No exploitation by hackers has been reported so far.

A 2018 fix that manufacturers never applied

Broadcom has known about the problem since 2018. The chipmaker then replaced WPS Monitor with hostapd, an open-source software, and recommended that manufacturers migrate. It considers the old code obsolete and outside its support period, hence its refusal to request a CVE. Quentin Kaiser believes this fix is incomplete. In his view, Broadcom's silence also explains why so many manufacturers never applied it. The US CERT/CC, which he had approached, closed the case on August 4, since Broadcom is authorized to assign its own CVEs. For the oldest routers, which run the eCos operating system, there may be no migration path at all. The researcher describes a flaw that will never be fixed.

He gave manufacturers 90 days starting July 18. According to Techzine, Proximus met with the researcher, while Orange Belgium did not respond. The Centre for Cybersecurity Belgium (CCB) has been informed.

What to do if your router is on the list

Without a patch from Broadcom, the answer depends on each operator:

• Do not rely on turning off WPS in the settings. According to the researcher, this option may leave the vulnerable code running.
• Ask your operator or the manufacturer whether an update specifically fixes WPSplinter.
• Companies can identify affected devices with the remote identification script and the YARA rules published by the researcher. The result must then be confirmed against the exact firmware version.
• As a precaution, at a sensitive site equipped with a listed router, you can turn off the built-in Wi-Fi and use a separate, up-to-date access point, after checking this choice with the operator.

It remains to be seen whether operators will push an update to hundreds of thousands of subscribers, and whether routers running eCos will simply have to be replaced.