Broadcom Wi-Fi parser flaw leaves millions of ISP gateway routers open to remote takeover
Unauthenticated heap overflows in legacy WPS code allow arbitrary code execution over the air across multiple router brands.
Technology news
Security researcher Quentin Kaiser has disclosed two critical vulnerabilities in Broadcom's proprietary 802.11 Wi-Fi implementation that leave millions of ISP broadband routers and gateways vulnerable to unauthenticated remote code execution (RCE) over the air. Present in Broadcom's software development kits since at least 2010, the bugs allow an attacker situated within wireless transmission range to gain complete root control over affected hardware without requiring a Wi-Fi password or completed WPS pairing.[2]
The vulnerability stems from an 802.11 Wi-Fi Protected Setup (WPS) EAP fragment reassembly overflow inside Broadcom's legacy WPS parser. Kaiser discovered the flaws through agentic vulnerability research, granting an autonomous AI agent direct access to cable modem firmware, serial debugging consoles, Ghidra decompilation pipelines, and custom GDB stubs to uncover the memory-safety flaws in days rather than months. Two distinct platform variants were identified: one targeting eCos-based architectures (BCM3380, BCM3383, BCM33834) and another impacting Linux-based platforms (BCM3390, BCM65xx, BCM68xx).[2]
Broadcom acknowledged the issue, noting that it deprecated the flawed WPS Monitor stack in favor of open-source hostapd and wpa_supplicant implementations starting in 2018. However, numerous major equipment manufacturers and telecom operators failed to integrate the modern stack. At the close of the 90-day responsible disclosure window on October 15, production gateways deployed by major providers—including Netgear CG3100/CG3700, Technicolor 7210/CGA4233, and Askey TCG3000 models—remained fully unpatched in the field.[2]
Our take: This disclosure underscores the enduring danger of legacy vendor SDKs embedded deep within carrier-grade consumer hardware. Decoupled from upstream security updates, carrier gateways often languish on firmware branches that are a decade out of date. With autonomous AI auditing tools now radically accelerating bug discovery in binary blobs, hardware vendors must establish automated firmware lifecycle pipelines or risk leaving critical home infrastructure permanently exposed to drive-by wireless exploitation.