A flaw in Broadcom’s proprietary 802.11 implementation reportedly allows an attacker within Wi-Fi range to execute code on affected routers without knowing the network password, completing WPS enrollment or obtaining any user interaction.
Researcher Quentin Kaiser presented the findings at Hexacon in Paris. According to Security Affairs’ October 19, 2026 report, vulnerable code has been present in Broadcom’s SDK since at least 2010.
Kaiser demonstrated exploitation against routers supplied by Orange Belgium and Proximus. He estimates that more than 1.5 million gateways could be exposed in Belgium alone, although that figure does not represent confirmed vulnerable devices, compromised systems or individual customers.
WPS EAP reassembly opens a pre-authentication attack path
The flaw affects WPS EAP reassembly code used during wireless setup. Kaiser says specially constructed Wi-Fi frames can reach the vulnerable component before an attacker has authenticated to the network.
Successful exploitation reportedly provides controlled information disclosure and arbitrary code execution. Because the attack is delivered over local radio rather than the internet, the adversary must be within Wi-Fi range. Kaiser said the close antenna placement used in his laboratory demonstration was not an operational requirement and that exploitation works over greater distances.
On an Orange Belgium ASKEY TCG3000, the demonstration extracted the Wi-Fi pre-shared key from NVRAM and transmitted it back over Wi-Fi. The researcher then used that PSK to join the network.
A separate demonstration targeted a Proximus Sagemcom F@st / BBOX3V+. In that case, the attack opened a reverse shell using Wi-Fi frames alone, without relying on an internet-accessible command server or cloud command-and-control infrastructure.
These tests show two distinct consequences: an attacker may be able to recover credentials protecting the local network, or obtain code execution directly on the gateway. Router-level access could also place traffic passing through the device at risk.
Chipsets span older eCos and Linux-based platforms
Kaiser identified the following chipset families in his assessment:
- eCos-based: BCM3380, BCM3383 and BCM33834
- Linux-based: BCM3390, BCM65xx and BCM68xx
He described the eCos issue as a “definitive forever day,” arguing that the underlying design prevents an effective repair. For Linux-based systems, he used the term “potential forever day,” because remediation depends on equipment manufacturers migrating away from the affected implementation.
Broadcom had recommended that manufacturers move to hostapd, according to Kaiser. He also said a patch released in 2018 did not fully correct the problem.
The demonstrated devices were:
- Orange Belgium ASKEY TCG3000
- Proximus Sagemcom F@st / BBOX3V+
Telenet equipment may also be affected through Sagemcom devices, but Kaiser could not obtain a unit to confirm that assessment. More broadly, the chipsets reportedly appear in hundreds of products from dozens of vendors, though the report does not provide a complete model list.
Belgian exposure estimate exceeds 1.5 million gateways
Using Belgian telecommunications market data, Kaiser produced a rough estimate of potentially exposed equipment:
| Provider or fleet | Estimated gateways |
|---|---|
| Proximus | approximately 850,000 |
| VOO legacy fleet | approximately 500,000 |
| Orange Belgium | approximately 210,000 |
He placed the combined figure at “north of 1.5 million” gateways. These numbers estimate deployment exposure; they do not establish how many routers contain exploitable firmware or have been attacked.
The practical risk is highest where untrusted people can remain within radio range, such as hotels and other shared environments, or where a specific nearby target is being monitored. Unlike a conventional internet-facing intrusion, the reported technique does not require the router’s management interface to be publicly accessible.
Patch claims conflict with device status
Kaiser said he reported the bugs to Broadcom in July 2026. In his account, Broadcom replied that a patch was available and instructed him to have affected device manufacturers contact the company directly.
That position sits uneasily beside Kaiser’s conclusion that the 2018 correction was incomplete. Security Affairs reported that, as of October 15, 2026, none of the affected Belgian devices had received a patch.
Kaiser also said Broadcom declined to assign a CVE and would not share the security notification distributed through its customer portal. CERT/CC subsequently opened a case but closed it the same day after confirming that Broadcom could issue CVEs itself and did not intend to do so.
This leaves deployment-level remediation with router manufacturers and internet service providers. Customers generally cannot replace vulnerable SDK code themselves.
Users of the named routers should check with their provider for a firmware update or hardware replacement specific to their model. Changing the Wi-Fi password alone would not prevent the initial unauthenticated trigger described by Kaiser, although a password change may still be appropriate if a key is suspected to have been exposed. Disabling WPS should not be treated as a confirmed workaround based solely on the available report.
Organizations managing gateways should prioritize inventories in locations where outsiders can easily remain within Wi-Fi range and apply manufacturer-supplied firmware as it becomes available. For eCos-based equipment, Kaiser’s assessment suggests replacement may be necessary if no supported correction is issued.
AI-assisted analysis shortened the research
Kaiser attributed the speed of the discovery to AI-assisted code analysis. “With AI frontier models it took me less than a week,” he said, compared with the months he estimated a manual review would have required.
That is the researcher’s assessment of his workflow, not an independent measure of the models’ capabilities. It nevertheless illustrates how AI-assisted analysis can reduce the time required to examine old, proprietary networking code—an advantage available to vulnerability researchers and potentially to attackers examining the same software.
