A Broadcom Wi – Fi vulnerability was demonstrated on October 16, 2026. Attackers were able to execute code on routers without knowing the network password as long as they were within the wireless coverage range. Reports indicate that this vulnerability can be traced back to at least 2010 and has existed for a long time in the Broadcom software development toolkit; by the end of the disclosure period on October 15, 2026, none of the devices checked in Belgium had been patched.

Key Points

• This WPS vulnerability allows unauthorized code to execute, and attacks can be initiated through Wi – Fi.
• It is estimated that over 1.5 million gateways in Belgium have been affected.
• Broadcom refuses to have CVE assigned to it, and its previous patches were not complete.

Broadcom Wi ‑ Fi How to bypass passwords through vulnerabilities

The vulnerability is located in the implementation of WPS at Broadcom, specifically in the code that reassembles shard EAP messages. A buffer overflow during this process can lead to memory corruption, access to sensitive data, and the execution of arbitrary code without authentication or user interaction.

WPS allows devices to join wireless networks without entering a password. This attack bypasses the password protection provided by WPA2 or WPA3, but it does not render these protection mechanisms ineffective.

The affected platforms include eCos devices that use BCM3380, BCM3383, and BCM33834, as well as Linux devices that use BCM3390, BCM65xx, and BCM68xx. The affected hardware covers ARM and MIPS architectures.

The demonstration of ONEKEY shows that it is possible to steal keys and obtain shell.

ONEKEY Chief Security Researcher Quentin Kaiser discovered this vulnerability and demonstrated it at the Hexacon conference held in Paris on October 16, 2026. His demonstration used two gateway devices deployed by a Belgian operator.

On a ASKEY TCG3000 device with the identifier Orange Belgium, Kaiser extracts the Wi – Fi keys in plaintext from NVRAM and then connects to the network. On a Sagemcom F device with the identifier Proximus at the address st / BBOX3V, it is able to establish a remote connection to shell using only 802.11 frames, without the need for a command server that can be accessed over the internet.

Kaiser indicates that the antennas in the video appear to be very close to each other, but this is due to the settings of the test bench, and such a distance is not required for the attack. This attack can also be carried out over a range of distances within the coverage area of Wi – Fi.

He released a fingerprint recognition script and a YARA rule to help identify affected devices. Kaiser also mentioned that artificial intelligence accelerated the analysis process, stating that what originally took months to complete could be done in less than a week with the help of cutting-edge models.

More than 1.5 million gateways in Belgium are affected

Estimates from Belgium indicate that the number of affected gateways exceeds 1.5 million, covering devices from three major operators. This includes approximately 850,000 Proximus gateways, 500,000 from the VOO old network, and 210,000 from Orange Belgium.

However, this Broadcom Wi – Fi vulnerability is not limited to deployments in Belgium: the relevant chips are used in hundreds of products around the world. The figure mentioned for Belgium is only used to measure the extent of exposure in that market and does not represent the total number of devices globally.

Incomplete patching and controversial disclosure process

Broadcom released an incomplete patch in 2018, and later recommended using hostapd instead of fixing its own code. On the eCos platform, this approach means that the vulnerability is essentially irreparable.

When contacted in July 2026, Broadcom indicated that a patch was already available and urged the manufacturer to apply it directly. The company refused to allocate CVE. CERT / CC opened and closed the related case within a single day.

When the 90-day disclosure period ended on October 15, 2026, none of the devices in Belgium that were under investigation had received any patches. Broadcom has not yet provided a complete fix for this vulnerability.

For this Broadcom Wi – Fi vulnerability, the identified direct countermeasures are: to disable WPS in the router settings, to modify the default administrator credentials, and to check for firmware updates provided by the operator.

This article was generated with the assistance of artificial intelligence and has been reviewed by an editorial team.