On October 16, 2026, security researcher Quentin Kaiser disclosed a flaw in Broadcom’s proprietary Wi-Fi implementation of Wi-Fi Protected Setup (WPS). Kaiser says crafted, fragmented WPS messages can corrupt memory and enable information disclosure or arbitrary code execution over Wi-Fi, without the network key or a completed WPS enrollment. His research describes the flaw and its reported scope.
What the reported flaw can do
WPS is a method for connecting devices to a Wi-Fi network. Kaiser says a flaw in Broadcom’s handling of fragmented WPS messages can let an attacker send the crafted messages over Wi-Fi and trigger memory corruption. The reported outcomes include controlled information disclosure and arbitrary code execution. The attack does not require the network key or completion of normal WPS enrollment, according to Kaiser.
Two gateways, two different demonstrations
Kaiser describes separate demonstrations on two Belgian ISP gateways. On Orange Belgium’s ASKEY TCG3000, the demonstration recovered the stored Wi-Fi pre-shared key (PSK), or network password, and used it to join the network. On Proximus’s BBOX3V+, it opened a reverse shell over 802.11 frames, a way to send commands to the device. Kaiser’s disclosure describes both results.
Belgian gateway models named in the disclosure
Kaiser reports exploitable gateways associated with three Belgian providers:
- Proximus: BBOX 3 and BBOX3V+.
- VOO: Netgear CG3100, Netgear CG3700, Technicolor TC7210, and CGA4233.
- Orange Belgium: ASKEY TCG3000.
Kaiser also marked Telenet’s F@ST3896LG and F@ST5685LGB for confirmation and said he could not test a Telenet unit.
His rough estimates put affected gateways at 850,000 for Proximus, about 500,000 for VOO’s legacy fleet, and 210,000 for Orange Belgium. Kaiser characterized the figures as medium-confidence estimates.
Patch availability and gateway status
Kaiser traces the vulnerable code to at least 2010. He says an incomplete patch appeared in 2018, when Broadcom recommended moving to hostapd, alternative Wi-Fi software. On July 28, 2026, Kaiser says Broadcom told him a patch was available and advised affected device makers to contact Broadcom. In a separate status report, Kaiser said the gateways he had identified remained unpatched as of October 15, 2026.
As of October 19, 2026, The Hacker News reported that it had found no CVE assigned to the flaw. At the October 16 disclosure, Kaiser said he knew of no real-world attacks using it.
Chip families and reported repair options
Kaiser identifies two groups of Broadcom chip families and describes different repair prospects for each in his disclosure.
| Chip platform | Chip families | Repair outlook described by Kaiser |
| eCos-based | BCM3380, BCM3383, BCM33834 | Kaiser says he found no usable fix for these families. |
| Linux-based | BCM3390, BCM65xx, BCM68xx | Kaiser says remediation may require device makers to migrate to different Wi-Fi software. |
Kaiser also published a firmware YARA rule and a live-access-point fingerprinting script as triage aids. He cautions that patched devices may still match the rule.
