# Broadcom router security vulnerabilities

> Live situation record from CLSTR: https://clstr.news/situations/broadcom-router-security-vulnerabilities
> Updated: 2026-10-24T08:02:00.000Z. Sources: 15. Developments: 3.

Security researcher Quentin Kaiser has identified a critical vulnerability, dubbed ‘WPSplinter’, affecting millions of Wi-Fi routers worldwide. The flaw resides in legacy Broadcom firmware code responsible for handling Wi-Fi Protected Setup (WPS). By sending specially crafted messages, an attacker within radio range can trigger a buffer overflow to extract Wi-Fi keys from memory or execute remote shell commands without a password.

The vulnerability stems from a memory error in a legacy component that has existed since at least 2010. While Broadcom released a partial fix in 2018 and later recommended transitioning to the ‘hostapd’ open-source solution, many manufacturers continue to use the vulnerable code, creating a significant gap in the software supply chain.

The impact is global, affecting hardware from manufacturers including Cisco, TP-Link, Netgear, Sagemcom, Nokia, ZTE, and Zyxel. In Belgium, an estimated 1.5 million devices are affected, including gateways from providers such as Proximus, Orange, and VOO. In Germany, models from Deutsche Telekom, such as the Speedport W 723V and W 724V, have been identified as potentially vulnerable. Additionally, the Spanish National Cybersecurity Institute (INCIBE) has coordinated the disclosure of multiple vulnerabilities affecting 4G routers used by Movistar and Orange, specifically impacting models from Askey, Comtrend, and MitraStar.

Recent warnings emphasize that the ‘WPSplinter’ flaw has persisted for 16 years. Researchers note that for many users, the issue remains unresolved despite the 2018 partial patch, and disabling WPS may not mitigate the risk. Affected manufacturers may also include Asus and Linksys.

## Claims

- The vulnerability is named ‘WPSplinter’. (corroborated by 9 sources)
- Attackers can extract Wi-Fi keys or execute remote shell commands without a password. (corroborated by 9 sources)
- The flaw is caused by a memory error in the legacy WPS component. (corroborated by 9 sources)
- The vulnerability requires the attacker to be within Wi-Fi range. (corroborated by 9 sources)
- Broadcom has known about the issue since 2018. (corroborated by 8 sources)
- Approximately 1.5 million devices are affected in Belgium. (corroborated by 4 sources)
- Broadcom declined to assign a CVE identifier to the flaw. (corroborated by 3 sources)
- Affected hardware manufacturers include Cisco, TP-Link, Netgear, Sagemcom, Nokia, ZTE, and Zyxel. (corroborated by 3 sources)

## Timeline

### 2026-10-24: Security researchers warn of critical vulnerabilities in Broadcom Wi-Fi software and PHP

Critical security flaws have been identified in Broadcom’s Wi-Fi software and the PHP programming language, risking remote device takeover and server data breaches.

4 sources. https://clstr.news/cluster/security-researchers-warn-of-critical-vulnerabilities-in-broadcom-wi-fi-software-and-php

### 2026-10-20: Movistar and Orange routers found to have serious security vulnerabilities

Critical security flaws in Broadcom components have exposed Movistar and Orange routers to unauthorized code execution by attackers within Wi-Fi range, according to INCIBE and researchers.

2 sources. https://clstr.news/cluster/movistar-and-orange-routers-found-to-have-serious-security-vulnerabilities

### 2026-10-20: Broadcom Wi-Fi vulnerability ‘WPSplinter’ exposes millions of routers

A critical Broadcom Wi-Fi flaw named ‘WPSplinter’ allows attackers within range to hijack millions of routers and steal Wi-Fi keys without a password.

9 sources. https://clstr.news/cluster/broadcom-based-modems-vulnerable-to-wpsplinter-wi-fi-flaw

---
Cite as: Broadcom router security vulnerabilities. CLSTR, https://clstr.news/situations/broadcom-router-security-vulnerabilities