Broadcom Wi-Fi bug turns sweet 16, still lets strangers hijack your router

A 16-year-old security flaw in Broadcom's Wi-Fi software could let attackers hijack millions of routers without knowing the network password, even though the chipmaker reportedly knew about the problem since 2018.

Security researcher Quentin Kaiser disclosed the vulnerability, dubbed "WPSplinter," revealing two bugs in Broadcom's proprietary Wi-Fi implementation that date back to at least 2010.

An attempted fix arrived eight years later, but Kaiser claims it didn't fully resolve the problem.

The bugs lie in Broadcom's handling of Wi-Fi Protected Setup (WPS), the feature that lets users connect devices to a wireless network without manually entering a password.

Kaiser found that specially crafted WPS messages could corrupt the router's memory, allowing someone within Wi-Fi range to run their own code on the device.

They wouldn't need the Wi-Fi password, and the router's owner wouldn't have to do a thing.

Kaiser demonstrated working exploits against routers supplied by Belgian internet providers Proximus and Orange.

In one attack against an ASKEY TCG3000 gateway, he ran code on the device, pulled its Wi-Fi password from memory, and sent it back over the air.

He then used the stolen credentials to join the network.

He also found the flaw in Netgear and Technicolor routers supplied by VOO.

He estimates that around 850,000 Proximus gateways could be affected, along with 500,000 at VOO and 210,000 at Orange Belgium.

That puts the potential total at 1.56 million routers in Belgium alone, although Kaiser admits the figures are rough estimates.

However, the problem is unlikely to stop at the Belgian border.

Broadcom's Wi-Fi technology is used by dozens of manufacturers across hundreds of products, meaning the number of affected devices worldwide could be considerably higher.