[CLSTR]
< Back to all clusters
[TECHNOLOGY] · Belgium, France, Spain, Taiwan, Germany · 11 sources

started · updated

Part of situation: Router and Wi-Fi hardware security vulnerabilities (2 clusters)

Broadcom Wi-Fi flaw allows router takeover without password

Broadcom WPSplinter router vulnerability cybersecurity WPS exploit

Security researcher Quentin Kaiser has disclosed a critical, 16-year-old vulnerability in Broadcom’s proprietary Wi-Fi Protected Setup (WPS) implementation, dubbed ‘WPSplinter’. The flaw, which dates back to at least 2010, allows attackers within Wi-Fi range to execute arbitrary code with root privileges on affected routers without needing the network password or completing the standard WPS pairing process.

The vulnerability stems from improper handling of fragmented WPS messages, leading to a buffer overflow. Kaiser demonstrated the exploit by extracting Wi-Fi passwords from device memory and gaining remote shell access. While Broadcom reportedly released an incomplete patch in 2018, many devices remain unpatched, particularly those using eCos-based platforms, which Kaiser describes as a ‘forever day’ vulnerability.

Millions of devices worldwide are potentially affected, including models from manufacturers such as TP-Link, Cisco, Nokia, ZTE, Sagemcom, and Netgear. In Belgium, Kaiser estimates approximately 1.56 million routers are at risk, specifically mentioning providers like Proximus, VOO, and Orange Belgium. In France, specific models like the Orange Livebox 5 and SFR Box Plus have been identified as vulnerable. In Spain, operators such as Movistar and O2 are also impacted. Broadcom has declined to assign a CVE number to the vulnerability, complicating the mitigation process for manufacturers and service providers.

Entities

Broadcom · Hexacon · Movistar · Orange · Orange Belgium · Proximus · Quentin Kaiser · SFR

Claims

What the coverage asserts, and how many sources carry each claim.

Sources

16-Year-Old Broadcom Wi-Fi Bug Lets Attackers Take Over Routers Without a Password [cybernoz.com]
Faille WiFi WPS Bbox : la Bbox WiFi 7 est corrigée [www.bbox-mag.fr]
Alertan de que cambiar la contraseña no sirve ante la vulnerabilidad de Broadcom que afecta a los routers de Movistar [www.diarioestrategia.cl]
博通 Wi-Fi 漏洞潛藏 16 年，攻擊者免密碼即可劫持路由器 | TechNews 科技新報 [infosecu.technews.tw]
Broadcom-Wi‑Fi-WPS-Lücke: Angreifer holen Root-Zugriff über Funk [www.it-boltwise.de]
Descubierta una vulnerabilidad en routers de Movistar, Jazztel, MásMóvil y O2: estos son los modelos afectados [www.adslzone.net]
Livebox 5 et Box SFR : vos données bancaires en danger depuis 16 ans [www.economiematin.fr]
Une vieille faille Wi-Fi expose des box Orange et SFR [www.generation-nt.com]
博通 Wi‑Fi 漏洞曝光：无需密码，攻击者也能拿下你的路由器 - IT之家 [www.ithome.com]
16-Year-Old Broadcom Wi-Fi Bug Lets Attackers Take Over Routers Without a Password [securityaffairs.com]
Broadcom Wi-Fi bug turns sweet 16, still lets strangers hijack your router [www.theregister.com]