Affected Systems

Broadcom Wi-Fi Protected Setup (WPS) implementation in routers and access points. Vulnerable chip families: older eCos-based models (BCM3380, BCM3383, BCM33834) - unpatchable "forever day"; newer Linux-based models (BCM3390, BCM65xx, BCM68xx) - patchable if vendors switch to hostapd. Millions of devices worldwide estimated affected, including gateways from Proximus, Orange Belgium, VOO, Cisco small-business APs, Huawei, and ARRIS routers. Flaw dates to at least 2010; incomplete fix shipped in 2018.

Exploitation Status

Working proof-of-concept exploits demonstrated by researcher Quentin Kaiser. Two exploits shown: Wi-Fi credential extraction (Askey TCG3000) and reverse shell over Wi-Fi frames (Sagemcom BBOX3V+). No CVE assigned. No real-world attacks reported as of October 19, 2026. Attack works at distance within radio range, no network password or pairing required.

Business Impact

Attackers within Wi-Fi radio range can execute arbitrary code as root on vulnerable Broadcom-based routers without authentication. Enables credential theft, persistent backdoor installation, and lateral movement. No patch available for eCos-based chips; Linux-based chips require vendor firmware updates switching to hostapd. No CVE assigned due to Broadcom's refusal to register the flaw despite knowing about it since 2018. Particularly dangerous for organizations in shared buildings or near public spaces where adversaries can position themselves within radio range. Russian state actors have previously used similar proximity-based Wi-Fi attacks for network compromise.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Identify Broadcom-based routers and access points in your environment using Kaiser's published YARA rules against extracted firmware or live detection script
  • For eCos-based Broadcom chips (BCM3380, BCM3383, BCM33834): plan immediate replacement as no patch will ever be available
  • For Linux-based Broadcom chips (BCM3390, BCM65xx, BCM68xx): contact vendor for firmware updates that migrate WPS implementation to hostapd
  • Prioritize replacement or patching for devices in high-risk locations: ground-floor offices, shared buildings, or facilities near public access points where attackers can position within radio range
  • Monitor network logs for unexpected device joins, unusual Wi-Fi management frame activity, or signs of unauthorized root-level access on gateway devices

---

# Geopolitical Context

Geopolitical Context

The vulnerability represents a significant supply-chain security challenge affecting telecommunications infrastructure across multiple nations. The flaw, dating to at least 2010 with an incomplete vendor response in 2018, highlights systemic weaknesses in the embedded device ecosystem where chipset vulnerabilities cascade through dozens of equipment manufacturers. The attack vector—exploitation from within radio range without network credentials—is consistent with techniques previously attributed to Russian state-linked actors conducting proximity-based operations against hardened targets. While no state actor involvement is indicated in this disclosure, the technical characteristics align with operational requirements for intelligence services seeking covert network access in urban environments where physical proximity to target infrastructure is achievable. The absence of CVE assignment despite known vendor awareness since 2018 raises questions about coordinated vulnerability disclosure processes and the adequacy of current frameworks when vendors decline to formally track flaws in widely deployed products.

State Actor Alignment

No state actor involvement is indicated in the vulnerability discovery or exploitation. However, the researcher explicitly noted that the attack methodology—targeting devices from within radio range rather than over the internet—mirrors techniques previously employed by actors linked to Russian intelligence services for cross-street network compromise operations. The vulnerability's characteristics (pre-authentication remote code execution with root privileges, no network credentials required, operable at distance) make it operationally attractive for signals intelligence collection and network infiltration by state-sponsored actors. The prolonged unpatched status and lack of public disclosure since 2018 may have provided opportunities for sophisticated actors with independent discovery capabilities to exploit the flaw covertly.

Business Impacty pro region

The vulnerability affects telecommunications infrastructure across Europe and globally, with confirmed exploitation demonstrations against Belgian ISP-supplied gateways from Proximus, Orange Belgium, and VOO, representing hundreds of thousands of devices. The researcher's broader assessment indicates millions of Broadcom-based routers worldwide remain vulnerable, including equipment from Cisco, Huawei, and ARRIS deployed across enterprise and residential networks. For European telecommunications providers, the flaw presents immediate operational risk as many distribute Broadcom-based gateways to subscribers under managed service models, creating potential liability for customer data exposure. The proximity-based attack vector is particularly concerning in dense urban environments and near sensitive facilities where adversaries can position themselves within radio range. The absence of available patches for older eCos-based chipsets creates a permanent vulnerability class ("forever day") requiring hardware replacement, imposing significant capital costs on providers and enterprises. The case underscores broader European concerns about dependency on non-European chipset vendors and the limitations of regional cybersecurity frameworks when upstream vendors decline to participate in coordinated disclosure.

Forecast

If Broadcom continues to decline CVE assignment and public acknowledgment, affected device manufacturers are unlikely to prioritize remediation, leaving the vulnerability exploitable indefinitely on legacy hardware. Telecommunications providers may face regulatory pressure from European data protection authorities to identify and replace affected customer premises equipment, particularly if exploitation incidents emerge. If state-sponsored actors have independently discovered this flaw, the extended window of unpatched exposure may enable sustained intelligence collection operations against high-value targets in proximity to compromised devices. The researcher's public disclosure and proof-of-concept release will likely accelerate both defensive scanning efforts and adversary weaponization. Organizations operating in contested environments or near sensitive facilities should anticipate increased risk of proximity-based Wi-Fi attacks and may need to implement compensating controls such as physical security perimeters that exceed Wi-Fi radio range or wholesale replacement of Broadcom-based access infrastructure.