WPSplinter：旧版WPS代码可致路由器被攻陷
TechSpot报道称，Broadcom旧版WPS代码中的WPSplinter漏洞已存在16年，攻击者只需处于无线电覆盖范围内，无需Wi-Fi密码或完成WPS配对，即可读取路由器内存或执行代码。安全研究员Quentin Kaiser在Askey TCG3000上提取了Wi-Fi密钥，并在Sagemcom Proximus BBOX3V+上获得远程Shell，还在比利时三家ISP的网关上确认了漏洞。Kaiser还表示，AI工具帮助其不到一周便发现了该漏洞。
据TechSpot报道，该漏洞涉及比利时约150万台网关，并可能波及全球多家主要路由器厂商的设备，而AI辅助将漏洞研究周期缩短至不足一周。
- A Broadcom WPS flaw dating back to at least 2010 lets attackers within Wi-Fi range run code on routers without the password
- Broadcom told the researcher it replaced the code from 2018, but declined to assign a CVE, calling the software obsolete
- Changing your Wi-Fi password won't help, and disabling WPS may not either; firmware updates or replacement are the fix
A flaw in Broadcom's Wi-Fi software dating back to at least 2010 lets anyone within radio range take over a vulnerable router without its password, and the fix Broadcom says it shipped years ago never reached many routers that need it.
Security researcher Quentin Kaiser presented the bug at the recent Hexacon event alongside a detailed write-up, naming it 'WPSplinter', a name he admits to disliking; with no CVE assigned, it is the only label the flaw has.
The bug sits in Broadcom's legacy WPS Monitor, the component that handles Wi-Fi Protected Setup, the push-button pairing feature found on many home routers. When WPS messages arrive in fragments, the software stitches them back together without checking that the result fits in the memory set aside for it.
#Broadcom#Quentin Kaiser#Askey#Sagemcom#Orange#Proximus#VOO#Cisco#TP-Link#Netgear#Nokia#ZTE