On October 23, 2026, security researcher Quentin Kaiser qualified what can be concluded about Broadcom’s 2018 WPS patch: his reconstruction cannot be tied to an exact SDK release, and any remaining exploitability depends on the target build, memory layout, and library implementation. For router owners, the key detail is whether the device’s exact firmware contains Broadcom’s legacy WPS Monitor component.
The analysis adds context to NeoTeo’s earlier coverage of the Broadcom WPS flaw, with a specific U.S. device list and a closer look at what the patch reconstruction can establish.
What Kaiser’s patch reconstruction says
Kaiser’s October 23 analysis reconstructed code from leaked source snapshots and timestamps, rather than an authentic Broadcom repository. He said the reconstruction could not identify the exact SDK release or show when a code change reached deployed routers. His account describes possible residual exploitability under some build conditions, depending on the build, memory layout, and library implementation.
U.S. router models in the list
Kaiser’s public device list associates the ARRIS BGW210-700 and Nokia BGW320-505 with AT&T. It associates the ARRIS/CommScope X5001 with Comcast (Xfinity). Those entries identify particular models, not the status of every router supplied by either carrier. Hardware revisions and firmware can differ even within a model.
The software component behind the flaw
Wi-Fi Protected Setup (WPS) is a way to connect devices to a wireless network. The reported flaw lies in Broadcom’s legacy WPS Monitor, software that handles WPS messages. Kaiser describes two flaws in how it validates fragments while reassembling WPS messages carried through the Extensible Authentication Protocol (EAP).
On affected firmware, an attacker within Wi-Fi radio range can reach the parser before normal WPS enrollment. The attacker does not need the network password or a completed pairing. Kaiser reported memory disclosure and code execution on affected devices. In his demonstrations, an Orange Belgium ASKEY TCG3000 disclosed the Wi-Fi pre-shared key stored in NVRAM; a Proximus BBOX3V+ built by Sagemcom opened a reverse shell over 802.11 frames. Those results apply to the demonstrated gateways, not automatically to every Broadcom-based router.
A Broadcom chipset name alone does not establish whether a router contains the affected software. The same goes for OpenWrt: the firmware’s actual components matter, not just its name.
Belgian operators’ reported responses
In an update dated October 20, Kaiser reported that Proximus had disabled WPS across its BBOX fleet and planned fuller patching in the following weeks. He also reported that Telenet engineers had found no vulnerable wps_monitor process in their fleet, while Orange Belgium was considering a fleet-wide WPS action. These were separate operator responses, each with its own scope.
What to ask your provider
Kaiser’s public documentation warns users not to assume that turning off WPS in a router’s settings disables the vulnerable parser. Ask the internet provider or router manufacturer whether firmware for the exact model and revision addresses the legacy WPS Monitor component. A menu setting alone does not answer that firmware question.
