A flaw in Broadcom's Wi-Fi setup software allows attackers within radio range to execute code as root on routers without a network password or pairing.
Disclosed by researcher Quentin Kaiser, the vulnerability affects millions of devices globally across multiple chip models and lacks an over-the-air patch.
The vulnerability was discovered by security researcher Quentin Kaiser, who published his findings on October 16, 2026. The researcher tested the attack on home routers from three internet providers in Belgium. In one case, he was able to read the Wi-Fi password directly from the device, while in another, he opened a remote command prompt over the air.
The problem lies in the way Broadcom's code handles connection messages. When it receives specially crafted messages from close range, it causes corruption in the router's memory. This allows the researcher to read data from the device's memory and execute his own code.
On an Orange Belgium router, specifically the Askey TCG3000 model, the attack read the Wi-Fi password from the saved settings and allowed connection to the network. On a Proximus router, the BBOX3V+ model manufactured by Sagemcom, the attack opened a remote command terminal via wireless data, without the need for a cable or external computer.
READ ALSO
Gitea releases new update that fixes nine security vulnerabilities
Which devices are affected?
Broadcom's code is embedded in routers and devices from dozens of manufacturers, with estimates indicating that millions of devices worldwide are affected.
The vulnerable chips include older models as well as newer Linux-based ones. In Belgium, the researcher found the issue active in routers from Proximus, Orange Belgium, and VOO.
Why is there no correction or official number?
The issue has not been given an official identification number because Broadcom retains the authority to register and has declined to list one. According to reports, the company has known about the issue since 2018 and had advised its customers to use different software.
What can be done?
Because there is no software update or setting available to prevent the over-the-air attack, the researcher has published special detection files and a scan scan to identify vulnerable equipment. For devices that cannot be patched, the practical solution suggested is to replace them with new equipment.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
