The Router Bug That Never Got a CVE: Lessons from a 16-Year-Old Wi-Fi WPS Flaw

Most vulnerability management programs run on CVE identifiers: a scanner finds the ID, the team prioritizes it, and someone applies the patch. A flaw disclosed last week in Broadcom's Wi-Fi code shows what happens when that chain breaks at the very first link, because no CVE was ever assigned.

What was found

On October 16, 2026, security researcher Quentin Kaiser published details of a bug in Broadcom's proprietary implementation of Wi-Fi Protected Setup (WPS). The code that reassembles fragmented WPS (EAP) messages mishandles them, and crafted messages corrupt the device's memory. An attacker who is simply within radio range, without the Wi-Fi password and without any user interaction, can read memory from the router and run code as root.

Kaiser demonstrated it on ISP-supplied gateways in Belgium. On one, his payload read the Wi-Fi passphrase from NVRAM and sent it back over the air; on another, he opened a reverse shell carried entirely in Wi-Fi frames, with no internet-hosted server.

The code has been in Broadcom's SDK since at least 2010. Broadcom shipped an incomplete fix in 2018 and advised customers to move to the open-source hostapd, but declined to register a CVE. Older eCos-based chips (BCM3380, BCM3383, BCM33834) are effectively unfixable; newer Linux-based ones (BCM3390, BCM65xx, BCM68xx) can be fixed if the device maker switches Wi-Fi stacks. No in-the-wild exploitation has been reported.

What to do

• Turn off WPS on every gateway and access point, then confirm with a Wi-Fi analyzer that it is no longer advertised. Per the researcher's tooling notes, a device that does not advertise WPS is not affected.
• Build an inventory of the Wi-Fi gateways in branch offices, warehouses and remote workers' homes, including chipset and firmware.
• Ask your ISP or vendor whether the firmware has moved to hostapd, and plan replacement for models that will never be fixed.
• Do not treat the ISP gateway as a trust boundary: keep the internal network behind your own firewall and separate guest and IoT Wi-Fi.

The broader lesson

An asset inventory is not just servers and laptops. Edge devices, from an ISP modem to a cheap branch access point, are invisible to scanners if they are not on the list, and even more so when their flaws have no official identifier.

The full write-up with the affected chipsets and response steps is here: https://symantecland.com/broadcom-wifi-wps-bug-router-takeover-no-patch/?utm_source=medium&utm_medium=article&utm_campaign=sx_syndication

— Kazem Mortazavi, independent network-security consultant