The short answer: A 16-year-old flaw in Broadcom’s Wi-Fi software lets an attacker within wireless range run code on vulnerable routers without knowing your Wi-Fi password, without the WPS button being pressed, and without any action from you. Security researcher Quentin Kaiser disclosed the bug at the Hexacon conference in Paris on October 19, 2026. The flaw sits in the WPS EAP reassembly code of Broadcom’s proprietary 802.11 implementation, and it has been present in the company’s software development kit since at least 2010. Broadcom quietly shipped an incomplete fix in 2018 and then told device makers to migrate to a different software stack entirely, which leaves the bug effectively unfixable on the oldest affected chipsets.
What the Broadcom Wi-Fi bug actually is
The vulnerability is in how Broadcom’s proprietary Wi-Fi software handles WPS, the wireless setup feature that lets devices join a network with a button press or PIN instead of typing the full password. Specifically, the buggy code reassembles EAP messages during the WPS enrollment process. An attacker can send carefully crafted Wi-Fi frames that trigger the flaw, and the router processes them before any authentication takes place.
That detail is what makes this one unusual. Most router attacks require the password, a logged-in session, or a trick that gets a user to click something. This one needs none of that. Kaiser describes the outcome as controlled information disclosure plus arbitrary code execution, which in plain terms means the attacker can both read things they should not see and run their own code on the router.
The bug has been sitting in Broadcom’s SDK since at least 2010, making it 16 years old. Kaiser’s work builds on a partial fix Broadcom silently released in 2018. That patch did not fully resolve the problem. Instead of shipping a complete one, Broadcom recommended that manufacturers move to hostapd, the open-source alternative, leaving its own vulnerable code in place on many devices.
How the attack works in practice
Kaiser demonstrated working exploits against two real ISP-provided routers used in Belgium. In the first demo, against an Orange Belgium ASKEY TCG3000, the exploit code ran on the device and pulled the Wi-Fi password out of the router’s NVRAM memory. The router then sent the password back to the attacker over Wi-Fi, and Kaiser used it to connect to the network, proving the exploit worked end to end.
In the second demo, against a Proximus router (the Sagemcom F@st, also known as the BBOX3V+), the exploit opened a reverse shell. Notably, the reverse shell worked over Wi-Fi frames alone, without any command server reachable over the internet. That matters because it means an attacker does not need internet-facing infrastructure to control a compromised router, just proximity.
Do not let the laboratory setup fool you: the close antenna placement in Kaiser’s demo videos was for convenience, and he notes explicitly that the attack can work over much longer distances. The only real requirement is being within Wi-Fi range of the target.
The 2018 half-patch and the forever-day problem
When Broadcom released its incomplete patch in 2018 and told customers to migrate to hostapd, it effectively declared the vulnerability a permanent feature of the oldest hardware. Kaiser calls it a definitive forever day on eCos-based platforms, which cover chipsets like the BCM3380, BCM3383, and BCM33834. Those devices will likely never get a real fix.
On Linux-based platforms, including the BCM3390, BCM65xx, and BCM68xx chipsets, the situation is uncertain. The flaw is a potential forever day there too, unless the individual device manufacturers are willing to do the migration work. Given that most users rarely check the firmware on ISP-provided routers, and ISPs rarely rush to update legacy fleets, the outlook is not encouraging.
The disclosure process itself was a dead end. Kaiser reported the bugs to Broadcom in July 2026. Broadcom said a patch was available and told him the affected device manufacturers should contact Broadcom directly. The company refused to assign a CVE number and refused to share the notification it had sent through its customer portal. CERT/CC opened a case and closed it the same day after confirming that Broadcom could assign CVEs itself and had no intention of doing so. As of October 15, 2026, none of the affected devices in Belgium had received a patch.
How many devices are affected
Kaiser’s rough estimate, based on Belgian telecom market data, is sobering for a country of only 11.5 million people: around 850,000 affected gateways on Proximus, 500,000 in VOO’s legacy fleet, and 210,000 on Orange Belgium. That is more than 1.5 million potentially exposed routers in one small country. Telenet may also be affected through Sagemcom devices, but Kaiser could not confirm it because he could not obtain one for testing.
The global picture is worse and less clear. The chipsets in question appear in devices from dozens of vendors and hundreds of products worldwide. Nobody currently has a complete map of affected deployments. Kaiser is publishing a fingerprinting script and a YARA rule to help researchers and defenders figure out the true scope.
One detail from the disclosure stands out for what it says about the future of security research: Kaiser found the bugs in under a week using AI frontier models, work that he says would have taken him months on his own. Defenders can use that speed to hunt deeper into old infrastructure, but attackers can use it exactly the same way.
What you should do
The realistic risk here is the targeted attack: someone near you, a hotel network, or surveillance of a nearby target. Compromised routers are difficult to monitor, and attackers can quietly intercept or collect network traffic. A compromised ISP router is an ideal foothold, and once inside a network, attackers can move laterally. We have seen what follows in cases like the Warlock ransomware attacks, where a single unpatched entry point led to a full network takeover.
That said, here is what is practical for most people:
Check for router firmware updates. Open your router’s admin page and look for a firmware update option. If your ISP supplied the router, the ISP usually controls updates, so check their support pages or ask them directly whether your model is affected and whether a patch is coming.
Replace very old ISP hardware. If your router is more than five years old, especially an ISP-issued box, consider replacing it. The affected eCos-era chipsets are old silicon, and replacement removes the entire class of problem.
Change the router admin password. While this bug does not need the admin password, many routers are still running factory defaults. Hardening the basics costs nothing and closes the easier attack paths.
For businesses and IT teams: inventory any devices running on the listed Broadcom chipsets (BCM3380, BCM3383, BCM33834, BCM3390, BCM65xx, BCM68xx), apply whatever firmware updates your vendors ship, and watch for Kaiser’s fingerprinting script and YARA rule to assess exposure in your own fleets. Router flaws are a recurring theme at hacking competitions too, as seen at Pwn2Own Ireland 2026, where home network devices keep falling to researchers.
Frequently asked questions
Can a hacker break into my home Wi-Fi with this bug?
Only if your router uses one of the affected Broadcom chipsets and runs the vulnerable proprietary Wi-Fi software. The attacker also has to be within Wi-Fi range. This is a targeted-attack scenario rather than a mass internet worm, but ISP-supplied routers using old Broadcom hardware are exactly the devices least likely to ever get a patch.
Does the attacker need my Wi-Fi password?
No. That is the point of this vulnerability. The attack works during the WPS setup processing, before any authentication, and the researcher demonstrated extracting the Wi-Fi password from the router’s memory rather than needing it in advance.
Why is there no CVE number for this?
Broadcom declined to assign one. The researcher reported the flaw to Broadcom in July 2026 and requested a CVE, but Broadcom said a patch was available, directed device makers to contact it privately, and refused to assign an identifier. CERT/CC opened a case and closed it the same day. The lack of a CVE does not make the bug less real; it just makes it harder to track.
Will my router ever get a patch?
For the oldest chipsets (BCM3380, BCM3383, BCM33834), effectively no, because Broadcom never shipped a complete fix and recommended migration instead. For newer Linux-based chipsets, a fix depends entirely on whether your specific device manufacturer does the migration work. Given the track record so far, including zero patched devices in Belgium as of mid-October 2026, do not count on one.
Did Broadcom fix this back in 2018?
Only partially. An incomplete patch was silently released in 2018, and the vulnerabilities Kaiser disclosed still work against it. Broadcom’s official position afterward was that customers should migrate to hostapd, not that a complete patch for the vulnerable code would follow.
The broader lesson is one the industry keeps relearning: code that ships inside a chipset SDK can live on for well over a decade, inside millions of devices whose owners never think about firmware. Attacks like this one do not need a phishing email or a weak password, just an old piece of software and a radio within range. For more on how zero-day flaws are handled when they do surface, see our breakdown of the Apple zero-day disclosure and what it took to get users patched.