WPSplinter router flaw exposed millions of vulnerable devices
TechSpot reports that WPSplinter, a 16-year-old flaw in Broadcom's legacy WPS code, can let attackers within radio range read router memory or execute code without the Wi-Fi password or completed WPS pairing. Researcher Quentin Kaiser demonstrated Wi-Fi key extraction on an Askey TCG3000 and a remote shell on a Sagemcom Proximus BBOX3V+, while confirming the flaw on gateways from three Belgian ISPs. Kaiser also says AI tools helped him identify the bug in less than a week.
TechSpot reports that the flaw affected an estimated 1.5 million Belgian gateways and potentially devices from major router vendors worldwide, while AI-assisted discovery shortened the research process substantially.
- A Broadcom WPS flaw dating back to at least 2010 lets attackers within Wi-Fi range run code on routers without the password
- Broadcom told the researcher it replaced the code from 2018, but declined to assign a CVE, calling the software obsolete
- Changing your Wi-Fi password won't help, and disabling WPS may not either; firmware updates or replacement are the fix
A flaw in Broadcom's Wi-Fi software dating back to at least 2010 lets anyone within radio range take over a vulnerable router without its password, and the fix Broadcom says it shipped years ago never reached many routers that need it.
Security researcher Quentin Kaiser presented the bug at the recent Hexacon event alongside a detailed write-up, naming it 'WPSplinter', a name he admits to disliking; with no CVE assigned, it is the only label the flaw has.
The bug sits in Broadcom's legacy WPS Monitor, the component that handles Wi-Fi Protected Setup, the push-button pairing feature found on many home routers. When WPS messages arrive in fragments, the software stitches them back together without checking that the result fits in the memory set aside for it.
#Broadcom#Quentin Kaiser#Askey#Sagemcom#Orange#Proximus#VOO#Cisco#TP-Link#Netgear#Nokia#ZTE