Broadcom chipset vulnerability 'WPSplinter' threatens millions of routers

Cybersecurity researcher Quentin Kaiser has uncovered a critical security flaw, dubbed ‘WPSplinter’, affecting hundreds of millions of routers worldwide that utilize Broadcom chipsets. The vulnerability resides in the legacy code of the Wi-Fi Protected Setup (WPS) feature.

During a technical demonstration at the Hexacon security conference in Paris, Kaiser showed that the flaw allows attackers within Wi-Fi signal range to hijack devices without needing a password, PIN, or user interaction. The exploit targets how the software processes specific messages, enabling attackers to read router memory or perform Remote Code Execution (RCE).

In practical demonstrations, Kaiser successfully extracted Wi-Fi keys from an Askey TCG3000 router used by Orange Belgium and gained full remote shell access to a Sagemcom Proximus BBOX3V+ router. Reports indicate that Broadcom may have been aware of the vulnerability since 2018, highlighting a significant failure in the software supply chain for device updates.