A 16-year-old security flaw in Broadcom Wi-Fi software allows attackers to hijack millions of wireless routers over the air without a password. Security researcher Quentin Kaiser detailed the vulnerability, named WPSplinter, after finding that a 2018 patch never reached consumer devices.
Millions of wireless routers worldwide face a severe security threat due to an underlying software defect dating back 16 years. Security researcher Quentin Kaiser detailed the vulnerability, designated as WPSplinter, at the Hexacon conference in Paris on October 16. The flaw resides deep within Broadcom’s legacy code for Wi-Fi Protected Setup, a feature designed to connect devices to a network by pressing a button on the router rather than entering a manual password.
Rather than exploiting a weakness in the WPS PIN mechanism itself, the vulnerability stems from how Broadcom’s software handles specific message exchanges. By transmitting a precise sequence of crafted messages, an attacker within radio range can cause memory corruption on the gateway. This allows unauthorized actors to read device memory or execute external code entirely over Wi-Fi, without needing the network password or a completed pairing sequence.
How WPSplinter Exposes Millions of Gateways Across Europe and Beyond
The risk extends far beyond theoretical laboratory tests. Kaiser demonstrated the exploit on an Askey TCG3000 gateway supplied by Orange Belgium, extracting the Wi-Fi key directly from the device’s NVRAM, transmitting it back over the air, and joining the network.
In Belgium alone, Kaiser estimated that approximately 1.5 million routers distributed by major telecommunications providers are vulnerable. That figure includes devices deployed by major operators such as Proximus, VOO, and Orange. Because countless hardware manufacturers incorporate Broadcom chips and Wi-Fi technologies into their products, the global tally of vulnerable consumer and enterprise routers is estimated to reach into the low hundreds of millions.
The incomplete list of affected manufacturers includes Cisco, TP-Link, Netgear, Sagemcom, Nokia, ZTE, Zyxel, Asus, and Linksys. These devices have been deployed by global service providers such as Movistar, Optus, KPN, and Türk Telekom, affecting both residential households and corporate environments.
Why Broadcom and Internet Service Providers Failed to Patch the Flaw
Chipmakers ship software flaws regularly, but WPSplinter stands out because Broadcom reportedly issued a fix eight years ago that never reached consumer hardware. When Kaiser reported the security gaps to Broadcom in July, the company stated that it had known about the issue since 2018, had since replaced the old WPS code in its current software, and maintained that the affected code was obsolete and outside its support window.
Broadcom also declined to request a Common Vulnerabilities and Exposures identifier, keeping the issue invisible to the standard advisories and patch pipelines that router vendors and internet service providers rely upon. Without a CVE tracking the defect, warnings failed to filter down the supply chain.
Older routing hardware running on eCos systems powered by Broadcom chips—such as the BCM3380, BCM3383, and BCM33834 models—may never receive firmware updates. Devices utilizing BCM3390, BCM65xx, and BCM68xx chips also remain at risk unless their software is patched or replaced.
Users Should Contact Providers to Address WPSplinter Risks
Changing a wireless password offers no protection against WPSplinter, as the attack vector occurs entirely prior to network authentication. Disabling the WPS feature within the router's configuration menu does not guarantee safety, as the vulnerable code often remains active beneath the surface in affected firmware builds.
For everyday users, identifying whether a specific machine is vulnerable remains challenging due to the absence of a comprehensive list of affected models. Security analysts advise consumers to contact their internet service provider or hardware manufacturer directly, providing the exact device model and manufacturing year to check for available firmware updates.
- Switching off the ISP gateway’s built-in wireless functionality entirely.
- Placing the ISP gateway into bridge mode.
- Connecting an independent, up-to-date third-party router to handle wireless traffic securely.
As artificial intelligence tools continue to accelerate vulnerability research—noting that AI helped uncover this defect in less than a week—the discovery shows how difficult it is to secure infrastructure components whose support lifecycles have quietly expired.