Key points
- The vulnerability exists in Broadcom’s proprietary 802.11 implementation dating back to 2010.
- Attackers can execute code on affected routers without knowing the Wi-Fi password or using WPS.
- No patch has been confirmed for many affected devices, including some in Belgium as of October 2026.
Routers using Broadcom Wi-Fi chips from the BCM3380, BCM3383, BCM33834, BCM3390, BCM65xx, and BCM68xx families are affected by a remote code execution flaw. As of October 15, 2026, many of these devices have not received a fix. Security Affairs reports that the issue stems from Broadcom’s SDK, which has contained this vulnerability since at least 2010.
In plain English
An attacker within Wi-Fi range can take control of a vulnerable router without needing the network password. The flaw resides in how the router handles the Wi-Fi Protected Setup (WPS) process. Researcher Quentin Kaiser demonstrated that this allows unauthenticated remote code execution. This means an attacker can run commands on the device and extract sensitive data, such as the Wi-Fi password, from memory.
The background
Kaiser presented findings at Hexacon in Paris, showing working exploits against two consumer devices: the Orange Belgium ASKEY TCG3000 and the Proximus Sagemcom F@st/BBOX3V+. He successfully opened a reverse shell using only Wi-Fi frames. The attack does not require a command server accessible over the internet. Kaiser noted that an incomplete patch was released in 2018, but Broadcom later recommended migrating to hostapd instead.
What changes now
For devices running on eCos-based platforms like the BCM3380 series, this is considered a "forever day" unless manufacturers migrate firmware. Linux-based platforms may also remain vulnerable if original equipment manufacturers do not update their systems. As of the report date, none of the affected devices in Belgium had received a patch. Users must verify their router model and chipset to determine exposure.
Who needs to act first
Teams should prioritize updating internet-facing routers that use Broadcom Wi-Fi chipsets. Check inventory for devices running eCos or Linux firmware on the affected BCM series. If a vendor update is available, test it in a isolated environment before deploying to production. Back up current configurations to allow rollback if the update causes instability. If no fix exists, consider isolating these devices from sensitive networks or replacing them with hardware using different Wi-Fi implementations.
What to do and how to stay safe: Broadcom
- Verify if your router uses one of the affected Broadcom chipsets listed in the report.
- Check with your device manufacturer for any available firmware updates or migration guides.
- Monitor network traffic for unusual activity that may indicate unauthorized access or code execution.
- Consider replacing vulnerable hardware with devices that use different Wi-Fi stack implementations.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Can this attack be performed from far away?
Yes, the attack can work from a distance; close antenna placement was only used for laboratory demonstrations.
Is there a patch available for all affected devices?
No, as of October 15, 2026, many affected devices had not received a patch, and some may never receive one.
Does the attacker need the Wi-Fi password?
No, the vulnerability allows exploitation without knowledge of the network key or completion of WPS enrollment.
