Broadcom WPS flaw leaves routers exposed to over-the-air takeover

Broadcom WPS flaw leaves millions of routers exposed to over-the-air takeover

Monday, October 26 6:05 PM ET

Photo via TechRadar

A flaw in Broadcom's Wi-Fi software dating back to at least 2010 lets anyone within radio range take over a vulnerable router without its password, and the fix Broadcom says it shipped years ago never reached many routers that need it.

Security researcher Quentin Kaiser presented the bug at the recent Hexacon event, naming it 'WPSplinter'; with no CVE assigned, it is the only label the flaw has. The bug sits in Broadcom's legacy WPS Monitor, the component handling Wi-Fi Protected Setup. When WPS messages arrive in fragments, the software stitches them back together without checking that the result fits in the memory set aside for it.

An attacker can reach that code over the air before any pairing completes, so no PIN, no button press and no network key are required. Anyone in range can read the router's memory and run code on it. Unlike the WPS PIN brute-forcing attacks of the early 2010s, the weakness is in Broadcom's code, not the protocol itself.

On an Askey TCG3000 gateway supplied by Orange Belgium, Kaiser's code pulled the Wi-Fi password from the router's storage and sent it over the air; he then used it to join the network. On a Sagemcom-built Proximus BBOX3V+, he opened a remote shell running entirely over Wi-Fi frames. He says the attack works at long range, though he has not published a distance. Broadcom told the researcher it replaced the code from 2018, but declined to assign a CVE, calling the software obsolete. Changing the Wi-Fi password won't help, and disabling WPS may not either; firmware updates or replacement are the fix.