[CLSTR]
< Back to situation

[REVISION HISTORY]

Broadcom router security vulnerabilities

Updated 2 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-22 14:39 UTC → 2026-10-24 17:12 UTC · added removed

Security researcher Quentin Kaiser has identified a critical vulnerability, dubbed ‘WPSplinter’, affecting millions of Wi-Fi routers worldwide. The flaw resides in legacy Broadcom firmware code responsible for handling Wi-Fi Protected Setup (WPS). By sending specially crafted messages, an attacker within radio range can trigger a buffer overflow to extract Wi-Fi keys from memory or execute remote shell commands without a password. The vulnerability stems from a memory error in a legacy component that has existed since at least 2010. While Broadcom released a partial fix in 2018 and later recommended transitioning to the ‘hostapd’ open-source solution, many manufacturers continue to use the vulnerable code, creating a significant gap in the software supply chain. The impact is global, affecting hardware from manufacturers including Cisco, TP-Link, Netgear, Sagemcom, Nokia, ZTE, and Zyxel. In Belgium, an estimated 1.5 million devices are affected, including gateways from providers such as Proximus, Orange, and VOO. In Germany, models from Deutsche Telekom, such as the Speedport W 723V and W 724V, have been identified as potentially vulnerable. Additionally, the Spanish National Cybersecurity Institute (INCIBE) has coordinated the disclosure of multiple vulnerabilities affecting 4G routers used by Movistar and Orange, specifically impacting models from Askey, Comtrend, and MitraStar. Recent warnings emphasize that the ‘WPSplinter’ flaw has persisted for 16 years. Researchers note that for many users, the issue remains unresolved despite the 2018 partial patch, and disabling WPS may not mitigate the risk. Affected manufacturers may also include Asus and Linksys.

Versions

  1. 2026-10-24 17:12 UTC Broadcom router security vulnerabilities
  2. 2026-10-22 14:39 UTC Broadcom router security vulnerabilities
  3. 2026-10-21 22:57 UTC Broadcom router security vulnerabilities

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.