Broadcom Wi-Fi flaw leaves 1.56 million Belgian routers exposed
Security researcher Quentin Kaiser disclosed a Broadcom Wi-Fi vulnerability that can let an attacker within wireless range execute code on affected routers without the network password. He demonstrated the exploit on gateways used by Proximus and Orange Belgium; Kaiser estimates about 1.56 million Belgian routers may be affected, and said the devices he identified remained unpatched on 15 October.
Bottom line — Kaiser says the flaw dates to 2010; older eCos-based routers may have no route to a fix.
Go deeper 8
-
Kaiser traced the flaw to Broadcom’s handling of fragmented WPS messages, which can corrupt memory.
-
On an Orange Belgium ASKEY TCG3000, Kaiser extracted the stored Wi-Fi key; on a Proximus BBOX3V+, he opened a shell over Wi-Fi frames.
-
The Belgian estimate breaks down to about 850,000 Proximus gateways, 500,000 in VOO’s legacy fleet and 210,000 from Orange Belgium, according to Kaiser; he calls the figures rough.
-
Kaiser says Broadcom issued an incomplete patch in 2018 and later recommended switching to hostapd. The eCos-based chip families he identified may remain unpatchable.
-
The affected chip families named by Kaiser include eCos BCM3380, BCM3383 and BCM33834, and Linux BCM3390, BCM65xx and BCM68xx.
-
Kaiser says Broadcom told him a patch was available in July 2026 but declined to assign a CVE.
-
Kaiser published a Wi-Fi fingerprinting script and a YARA rule to help identify potentially affected devices; he cautions the tools are screening aids, not proof of exploitability.
-
Kaiser reported no evidence of real-world attacks in his disclosure.