[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

3 clusters · 15 sources · 20 days · First seen · Last updated

Router and Wi-Fi hardware security vulnerabilities

Overview

Security vulnerabilities have been identified in router software and hardware implementations.

In early October 2026, Asus reported critical flaws in its router software. The first involves the upload of VPN configuration files, where a specially crafted file can trick a router into executing commands. This specifically affects users configuring VPN services directly on the router. A second flaw involves leftover troubleshooting code that allows the activation of Telnet without standard security checks, potentially granting administrative privileges to an attacker.

By late October 2026, Asus released security updates to address three high-severity vulnerabilities, identified as CVE-2026-75775, CVE-2026-75779, and CVE-2026-93489. These primarily impact devices using the 3.0.0.6_102 firmware branch. Notably, CVE-2026-93489 is a critical authentication vulnerability that allows an unauthenticated attacker on an adjacent network to gain administrative access without valid credentials, potentially compromising all connected devices.

Separately, a long-standing vulnerability was identified in Broadcom’s proprietary 802.11 implementation. Dubbed ‘WPSplinter’ by security researcher Quentin Kaiser, the flaw dates back to at least 2010 and affects the Wi-Fi Protected Setup (WPS) EAP reassembly code. The vulnerability stems from improper handling of fragmented WPS messages, leading to a buffer overflow that allows attackers within range to execute arbitrary code with root privileges without needing a network password. Kaiser described the flaw as a ‘definitive forever day’ on certain eCos-based platforms. While Broadcom reportedly released an incomplete patch in 2018, millions of devices worldwide remain vulnerable.

Entities

ASUS · SFR · Movistar · Orange Belgium · Hexacon

Claims

What the coverage asserts, and how many sources carry each claim.

Timeline

  1. [TECHNOLOGY] 2 sources
    ASUS issues security updates for router vulnerabilities

    ASUS has released firmware updates to fix three high-severity security vulnerabilities that could allow attackers to gain unauthorized administrative control over certain router models.

  2. [TECHNOLOGY] 11 sources
    Broadcom Wi-Fi flaw allows router takeover without password

    A 16-year-old Broadcom Wi-Fi vulnerability, ‘WPSplinter’, allows attackers to hijack routers without passwords, affecting millions of devices globally including models from Orange and SFR.

  3. [TECHNOLOGY] 2 sources
    Asus warns of critical security flaws in router software

    Asus warns of two critical router vulnerabilities involving VPN configuration files and leftover troubleshooting code that could allow unauthorized administrative access.

Sources

adslzone.net · bbox-mag.fr · cybernoz.com · diarioestrategia.cl · economiematin.fr · finance.technews.tw · gamemag.it · generation-nt.com · it-boltwise.de · ithome.com · ljudochbild.se · lydogbilde.no · securityaffairs.co · theregister.co.uk · tuttotech.net

This summary has been updated 2 times: see revision history