Movistar’s customer guidance, reported on October 28, 2026, is that customers in Spain do not need to change router settings or replace equipment. The operator says it is applying protective measures preventively and automatically.

What Movistar tells customers

Movistar also said it had no knowledge of unauthorized access or incidents on customer equipment. NeoTeo previously covered Movistar’s initial response to the Broadcom router flaw.

What the Broadcom WPS flaw can do

Security researcher Quentin Kaiser says the flaw affects Broadcom’s proprietary implementation of Wi-Fi Protected Setup (WPS), a feature for enrolling devices on a Wi-Fi network. Kaiser says an attacker within Wi-Fi range can trigger it without the network key or a completed WPS enrollment. Successful exploitation can disclose information from memory and allow arbitrary code execution with router-level privileges.

In a demonstration on an Orange Belgium device, Kaiser retrieved a Wi-Fi key stored in the router’s memory. He says the vulnerable implementation had been in Broadcom’s software development kit (SDK) since at least 2010, describes a 2018 patch as incomplete, and says a later SDK replaced affected components with hostapd.

Router models reported for Spanish operators

A Xataka Móvil report published October 28, 2026, listed these router models for operators in Spain:

  • Movistar: Comtrend VG8050, ZTE F680 v4, MitraStar GPT-2541GNAC, and Askey RTF3505VW.
  • O2: MitraStar GPT-2541GNAC and Askey RTF3505VW.
  • Orange and Simyo: Sagemcom Fast 5656.
  • Jazztel: ZTE F680 v4 and Sagemcom Fast 5656.
  • MásMóvil and Yoigo: ZTE F680 v4.