Secret Broadcom chip flaw lets nearby hackers take over millions of routers
No-password WiFi flaw puts millions of Movistar, Cisco, TP-Link, and Netgear routers at risk.
REUTERS/Dado Ruvic
Follow us
- A Broadcom chip flaw may expose millions of older routers from brands including Movistar, Cisco, TP-Link, and Netgear.
- Nearby attackers could exploit the bug over WiFi without knowing the network password.
- Quentin Kaiser estimates about 1.5 million routers in Belgium alone may be affected.
- Owners should seek firmware updates, because disabling WPS may not fix affected devices.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Millions of routers, including devices from Movistar, Cisco, TP-Link, Netgear, Nokia, and ZTE, may be exposed to an old Broadcom chip flaw that allows nearby attackers to execute malicious code without knowing the WiFi password.
The bug affects legacy WiFi software developed by chipmaker Broadcom and used in equipment distributed by internet providers worldwide.
It has been reported that Broadcom is aware of the issue, but has not issued a public advisory because the software it concerns falls outside its support window.
Security researcher Quentin Kaiser demonstrated the vulnerability at the Hexacon conference in Paris on Friday after using AI to help uncover the flaw.
In Spain, the affected devices include 3 older models supplied by Movistar, made by Askey, MitraStar, and Comtrend.
The ZTE f680 v4, distributed by Spanish operator MasMovil and internet providers in countries including Vietnam, Egypt, and Moldova, is also affected.
Broadcom flaw details
The vulnerability stems from an old memory handling error in Broadcom’s WiFi Protected Setup (WPS) software, dating back to around 2010, Kaiser notes, in his report.
An attacker can send a series of manipulated WPS connection messages to a router, causing it to combine more data than its memory can safely accommodate.
This can overwrite parts of the router's memory, potentially allowing the attacker to steal information or execute malicious code and take control of the device.
The attacker does not need the WiFi password or access to the network – they only need to be in wireless range, potentially allowing them to compromise routers from neighboring buildings or hotel rooms.
These kinds of vulnerabilities are perfect for threat actors that enjoy Nearest-Neighbor Attacks or hotel network compromises,says security researcher Quentin Kaiser in his analysis of Broadcom chip flaw.
“Highly targeted, over the air, against devices which defenders have very limited visibility into, allowing for traffic manipulation and collection,” he says.
He also hinted that the range might extend further than the antennas visible in his demonstration video, which used an Orange Belgium router, although he didn’t specify a distance.
“Don’t be fooled by the antenna proximity. This attack works over long distances,” Kaiser said.
Kaiser estimates that around 1.5 million routers in Belgium alone are affected, including 850,000 supplied by Proximus, 500,000 from cable operator VOO devices, and 210,000 from Orange Belgium.
These figures, the researcher adds, are “napkin maths” and the global total remains unknown.
Broadcom knew about flaw, researcher claims
According to Kaiser, Broadcom says it has known about the issue since 2018 but declined to assign a formal CVE security identifier or publicly disclose it because the affected software was obsolete and outside its support window.
Although Broadcom replaced the vulnerable component in newer software, older devices have remained exposed.
Kaiser claims the company’s failure to publicly address the flaw has contributed to manufacturers not issuing patches.
Is your model affected?
The researcher has released a free tool on GitHub to help identify affected equipment. It includes a wireless scanning script and a YARA rule, which checks router firmware for patterns matching the flawed software.
Owners should contact their internet provider or the manufacturer about firmware updates and consider replacing unsupported routers.
Kaiser adds that simply disabling WPS may not eliminate the vulnerability, and said the affected devices he examined remained unpatched as of October 15th.
Cybernews has approached Broadcom for comment.
Researcher used AI to find flaw
Kaiser said that he used OpenAI's Codex coding agent, in GPT 5.6 mode, to analyze the router firmware and develop exploits. Using AI, he said, helped save him months.
Separately, MikroTik Routers have also been found to be critically vulnerable to external attackers, who can similarly break in without a password.
Earlier this month, an anonymous researcher reported the severe flaw directly to the US Cybersecurity and Infrastructure Security Agency (CISA).
