ASKEY TCG3000

Broadcom Wi-Fi Chip Flaw Allows RCE via WPS, Unpatched for 16 Years and Affecting Millions of Devices

Security researcher Quentin Kaiser disclosed a critical buffer overflow vulnerability in Broadcom's proprietary Wi-Fi Protected Setup (WPS) implementation during Hexacon 2026 in Paris. The flaw, present in Broadcom firmware since around 2010, enables attackers within Wi-Fi range to read the PSK directly from memory or achieve root-level remote code execution without authentication or completing the WPS pairing process. Kaiser demonstrated working proof-of-concept exploits on routers from Orange Belgium and Proximus, including the ASKEY TCG3000 and Sagemcom F@st BBOX3V+. Although a partial fix appeared in 2018, it did not cover all code paths, and no patches were issued for older eCos-based chips, leaving the issue as a permanent "forever day" vulnerability. Broadcom, acting as its own CNA, refused to assign a CVE identifier, and a CERT report was closed the same day it was filed.