[CLSTR]
< Back to situation

[REVISION HISTORY]

Router and Wi-Fi hardware security vulnerabilities

Updated 2 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-20 10:37 UTC → 2026-10-26 10:43 UTC · added removed

Security vulnerabilities have been identified in router software and hardware implementations. In early October 2026, Asus reported two critical flaws in its router software. The first involves the upload of VPN configuration files, where a specially crafted file can trick a router into executing commands. The This specifically affects users configuring VPN services directly on the router. A second flaw involves leftover troubleshooting code that allows the activation of Telnet without standard security checks, potentially granting administrative privileges to an attacker. By mid-October late October 2026, Asus released security updates to address three high-severity vulnerabilities, identified as CVE-2026-75775, CVE-2026-75779, and CVE-2026-93489. These primarily impact devices using the 3.0.0.6_102 firmware branch. Notably, CVE-2026-93489 is a separate, critical authentication vulnerability that allows an unauthenticated attacker on an adjacent network to gain administrative access without valid credentials, potentially compromising all connected devices. Separately, a long-standing vulnerability was identified in Broadcom’s proprietary 802.11 implementation. Dubbed ‘WPSplinter’ by security researcher Quentin Kaiser, the flaw dates back to at least 2010 and affects the Wi-Fi Protected Setup (WPS) EAP reassembly code. The vulnerability stems from improper handling of fragmented WPS messages, leading to a buffer overflow that allows attackers within range to execute arbitrary code with root privileges without needing a network password. Kaiser described the flaw as a ‘definitive forever day’ on certain eCos-based platforms. While Broadcom reportedly released an incomplete patch in 2018, millions of devices worldwide remain vulnerable, including models from TP-Link, Cisco, Nokia, ZTE, Sagemcom, and Netgear. Specific impacts were noted in Europe, including providers such as Proximus, VOO, and Orange Belgium in Belgium; Orange Livebox 5 and SFR Box Plus in France; and operators Movistar and O2 in Spain. Broadcom has declined to assign a CVE number to the vulnerability, which complicates mitigation efforts for manufacturers and service providers. vulnerable.

Versions

  1. 2026-10-26 10:43 UTC Router and Wi-Fi hardware security vulnerabilities
  2. 2026-10-20 10:37 UTC Router and Wi-Fi hardware security vulnerabilities
  3. 2026-10-19 02:48 UTC Router and Wi-Fi hardware security vulnerabilities

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.