Security researcher Quentin Kaiser presented a critical vulnerability in Broadcom Wi-Fi firmware at the Hexacon 2026 conference in Paris. The flaw resides in the vendor's proprietary implementation of Wi-Fi Protected Setup (WPS) and has remained unpatched for nearly 16 years.
The vulnerability is a buffer overflow that occurs when the firmware incorrectly reassembles fragmented WPS configuration packets. Successful exploitation allows an attacker within radio range to read the Wi-Fi PSK from device memory or execute arbitrary code with root privileges. No knowledge of the existing Wi-Fi password and no completion of the WPS pairing procedure are required.
Kaiser released two proof-of-concept tools demonstrating memory disclosure and remote code execution. On an ASKEY TCG3000 router used by Orange Belgium he extracted the PSK and used it to join the network automatically. On a Sagemcom F@st BBOX3V+ device supplied by Proximus he achieved unauthenticated root shell access.
The vulnerable code has existed in Broadcom firmware since approximately 2010. A partial mitigation released in 2018 did not address all affected code paths. Devices based on the older eCos operating system received no patches at all, creating a permanent exposure that Kaiser described as a "forever day" vulnerability.
Broadcom, which holds CNA authority for its own products, declined to issue a CVE identifier. A report submitted to CERT was closed the same day, citing the vendor's refusal to register the issue. The researcher estimates that the affected code is present in routers and access points from dozens of manufacturers, potentially impacting millions of devices worldwide.
Users of unsupported hardware are advised to replace the devices or disable WPS entirely, as no further firmware updates are expected.
