WPSplinter Broadcom Router Flaw: Why WPS Off and Wi-Fi Password Changes Don’t Fix It

Before anyone starts a fire sale on their home router, some care is needed. Not every Broadcom-based device is affected. "Remote" here means "within Wi-Fi range", not "anywhere on the internet". And the researcher says his list of affected devices is incomplete. Here is what is known, what isn't, and what Windows users and IT administrators can do about it.

What WPSplinter actually is​

WPS is the convenience feature that lets a device join a network without typing the password. People who follow security have distrusted it for years. This bug is not the old WPS PIN brute-force problem. It is a memory-safety flaw in how Broadcom's own WPS software puts incoming messages back together.

According to the researcher's documentation page, Broadcom's legacy WPS Monitor implementation does not correctly constrain reassembled EAP-WPS fragments to the size of its destination buffer. In plain terms, an attacker sends a series of message fragments, and the router stitches them into a buffer that is too small for the result. A nearby attacker can reach the parser over Wi-Fi without knowing the network key or completing WPS enrollment. On vulnerable devices, this can cause controlled memory disclosure and arbitrary code execution.

The Register reports that Kaiser found two bugs in Broadcom's proprietary Wi-Fi implementation that date back to at least 2010. That makes the bug about 16 years old. Kaiser presented the work at Hexacon in Paris; his documentation dates the talk to 16 October 2026. Cybernews reports that he used AI to help find the flaw. That fits an earlier post on his blog, where he described giving an AI agent a cable modem, a serial console, Ghidra and a custom debugger stub, then asking it to hunt for bugs in the firmware.

Key point: this is a pre-authentication memory-corruption bug. The attacker never needs to be on your network.

The demos: from radio signal to root shell​

The demonstrations are what move this from a theoretical risk to a practical one. Techzine reports that Kaiser demonstrated the attack on an ASKEY TCG3000 from Orange Belgium. His shellcode extracted the PSK from the NVRAM and sent it back to the attacker via 802.11. He then used that key to connect to the network. The same outlet notes that on a Proximus BBOX3V+, he obtained a reverse shell over 802.11 frames. This didn't require a C2 server in the cloud.

The second demo matters a great deal for defenders. A reverse shell carried over Wi-Fi frames never touches the WAN connection. An ISP watching upstream traffic, or a company watching its firewall logs, may see nothing at all. Kaiser himself summed up the threat as "Highly targeted, over the air, against devices which defenders have very limited visibility into, allowing for traffic manipulation and collection".

How close does an attacker need to be? According to The420.in, Kaiser said the flaw suits highly targeted attacks, including compromises from neighbouring buildings or hotel rooms. Cybernews adds that he suggested the range could go beyond the antennas shown in his demo video, but he didn't specify a distance. Treat claims about long range as unquantified for now.

The impact also varies from device to device. Some coverage describes root-level code execution, but the researcher's own FAQ says the exact privileges and consequences depend on the product and firmware. "Full takeover" has been shown on specific devices. It has not been confirmed in the same form on every model listed.

Who is affected, and how sure can you be?​

Here the details matter. Kaiser's research covers Broadcom's legacy WPS Monitor stack on both eCos and Linux. The SoC families he has identified include BCM3380, BCM3383, BCM33834, BCM3390, BCM63xx, BCM65xx and BCM68xx. His documentation also says a chipset match alone does not prove a device's firmware is vulnerable. What matters is whether the firmware uses the old WPS Monitor code.

The researcher's list, which he says is not exhaustive, includes these devices:

Some entries are less certain. Huawei's B310, B315, B593 and WS880 are listed with a note to verify firmware. The Neuf NB6 and NB6VAC and the Tenda D301/N300 are marked as reported, with assessment still ongoing. The detection project's README warns that the full list could eventually run to thousands of makes and models.

How many devices does that add up to? Kaiser estimates that more than 1.5 million routers could be affected in Belgium alone. The420.in notes that he described the figure as rough and said the global number remains unknown. Treat it as an informed estimate, not a measured count, and avoid inventing a global figure from it.

Key point: Cisco's small-business WAPs and RV routers are on the list. This is not only a consumer ISP-gateway problem. Branch offices and small businesses should check their equipment too.

The disclosure saga: a fix, but not quite​

The patch history explains why such an old bug is still causing trouble. The Register reports that an attempted fix arrived eight years later, but Kaiser claims it didn't fully resolve the problem. Broadcom told the researcher it began replacing WPS Monitor with the open-source hostapd in 2018. Moving new products to hostapd does nothing for devices already sold. Every OEM and ISP still has to build, test and ship updated firmware. Kaiser's documentation warns that older eCos-based products may have no way to migrate at all.

According to Neowin, Kaiser reported the bug to Broadcom in July with the usual 90-day deadline. Initially, Broadcomm told him that a patch was available and that he should reach out to vendors, but then it failed to assign a CVE number or provide a copy of the notification sent to vendors. He then contacted Proximus, Orange and VOO, but got little response. He also filed a report with CERT/CC in August. That case was closed the same day, because Broadcom is a CVE Numbering Authority and had chosen not to assign a CVE.

Broadcom's reason, according to the researcher's FAQ, is that the affected software is obsolete and outside its support window. Cybernews similarly reports that Broadcom has not issued a public advisory because the software it concerns falls outside its support window.

A fair counterpoint​

Broadcom's position has some logic to it. Chip vendors do supply SDKs to OEMs, and the OEMs decide what goes into each shipped firmware image. But this case shows a real gap in how vulnerabilities get tracked. If a bug has no CVE, vulnerability scanners don't flag it, asset-management tools don't report it, and procurement teams can't ask about it. "End of support" can mean the vendor has stopped maintaining the code. It does not mean the code has stopped running in people's homes. Neowin's "16 years" headline is accurate, but the more useful lesson is about supply chains: one shared component, many vendors, and nobody clearly responsible for fixing it.

As of the reporting on 19 October, Mallory's timeline noted no assigned CVE, deployed fix for the affected routers, or known real-world exploitation. The last point, no known exploitation, is reassuring for now. That could change quickly now that the technical details are public.

What you should do right now​

For home users​

1. Identify your exact router. Check the label on the bottom of the router for the model and hardware revision. If your ISP supplied the box, write down the provider's model name as well. ISPs often rebrand gateways (KPN's "Experia Box" is one example from the list).
2. Check the firmware version in the router's admin page and install any update available. Many ISP gateways update automatically, so the update may come from your provider rather than from you.
3. Ask your ISP or manufacturer directly whether your firmware fixes the Broadcom WPS Monitor issue. Since there is no CVE number, use the name "WPSplinter" and mention the Broadcom WPS EAP fragment reassembly flaw.
4. Don't rely on a password change. The attacker never needs your network key.
5. Don't rely on the WPS toggle either. Kaiser's FAQ says a settings switch may not remove or fully disable the vulnerable parser. Turning WPS off is still sensible general hygiene, but confirm the fix with your vendor.
6. Replace unsupported hardware. If the vendor or ISP can't confirm a fix and the device is past end of life, replacing it is a reasonable precaution. If it's an ISP gateway, ask the provider for a newer model.

For IT administrators and power users​

Kaiser has published an MIT-licensed detection toolkit with two ways to check devices:

• Static analysis: YARA rules that scan extracted firmware for the WPS Monitor binary and for the code pattern linked to the vulnerable reassembly path. The README gives yara -w -r broadcom_wps_monitor.yar extracted_firmware_dir as the basic command. It also warns that the rules are triage aids: compiler changes can evade the patterns, and a patched binary can still match some strings.
• Over-the-air fingerprinting: a Python/Scapy script run from a Linux wireless interface in monitor mode. It looks for Broadcom's proprietary information elements, then sends a zero-length fragmented frame. hostapd replies with an ACK, while Broadcom's wps_monitor replies with a NACK. Results come back as LIKELY_VULNERABLE, PATCHED_HOSTAPD or INCONCLUSIVE.

Windows-only shops should note that the fingerprinting script expects Linux tools (ip, iw) and an adapter that supports monitor mode. A Linux live USB or WSL with passthrough for a suitable USB adapter is the practical route. Built-in laptop Wi-Fi usually won't work.

There is one wrinkle in the documentation. The README says an access point that doesn't advertise WPS isn't affected, and the script returns INCONCLUSIVE in that case. The FAQ, meanwhile, warns that switching WPS off in settings may not disable the parser. If you're auditing a fleet, treat "not advertising WPS" as lower risk, not as cleared, until the firmware has been checked. The project prefers firmware extraction and YARA when an image is available.

Enterprises should also check Cisco RV and WAP units in branch offices. Treat this as an asset-inventory job as well as a patching job, because without a CVE your scanners won't find these devices for you.

Key point: confirm the firmware with the vendor, use the toolkit to triage, and replace what can't be fixed. Password changes and settings toggles are not a fix for this bug.

The bigger picture​

WPSplinter adds to a familiar pattern of router research: shared SDK code, slow OEM patching and no clear owner of the fix. Kaiser has found router flaws before. His earlier VOOdoo research on VOO's Netgear modems and his "Clockwork Orange" work on Orange Belgium's Askey gateways involved some of the same ISPs. This time, though, the problem is a single parser buried in a chip vendor's SDK and shipped across continents.

AI-assisted bug hunting adds another concern. If an AI agent can help one researcher find this bug in an old cable modem, other people can use the same methods, and the routers nobody plans to update are an easy target. Your router is the gateway between your Windows PCs and everything else, so it deserves at least as much attention as Patch Tuesday.