16-year-old Broadcom Wi-Fi bug lets attackers hijack routers without a password

Researcher Quentin Kaiser presented at Hexacon in Paris a flaw in Broadcom's proprietary 802.11 implementation present in its SDK since at least 2010. An attacker within Wi-Fi range can achieve unauthenticated remote code execution without the network key or WPS; over 1.5 million gateways may be exposed in Belgium alone, with no patch.

• Flaw in WPS EAP reassembly code enables unauthenticated code execution
• Broadcom shipped an incomplete fix in 2018 and advised migrating to hostapd
• Bug is permanent on eCos chips BCM3380/3383/33834, Linux chips depend on OEMs
• Kaiser estimates over 1.5 million exposed gateways in Belgium alone