A bug sitting in router chips since 2010 lets a neighbour take over your Wi-Fi box

Your router password does nothing here. That is the uncomfortable part of the research Quentin Kaiser presented at Hexacon in Paris on 16 October. The flaw lives in Broadcom's own Wi-Fi Protected Setup code, in the way it reassembles setup messages that arrive split into fragments. Send the pieces in the wrong order, deliberately, and the router's memory gets corrupted. From there an attacker standing within Wi-Fi range runs code as root. They never join the network, never type the password, never press the WPS button.

Kaiser did not stop at theory. He pulled the Wi-Fi password straight out of an Askey TCG3000 gateway of the sort Orange Belgium hands out, and opened a reverse shell on a Proximus Sagemcom BBOX3V+ over Wi-Fi frames alone. The affected chip families stretch across BCM3380, BCM3383 and BCM33834, which run eCos and cannot realistically be patched, and BCM3390, BCM65xx and BCM68xx, which run Linux and in principle could be. He estimates around 1.5 million affected routers in Belgium alone, and the same Broadcom code sits inside gear sold under a long list of other brands.

Broadcom's answer is that a fix has existed since 2018 and that vendors should move to hostapd instead. It declined to assign a CVE. The code has been shipping since at least 2010. Kaiser found no setting you can toggle over the air to stop the attack, so the honest advice is narrow: ask your internet provider whether your gateway model is affected and whether firmware is coming, and if the answer is that it is end of life, push for a replacement box.

Knowing what is actually on your network is the starting point, and Tendvane's Network scan will list every device sharing your Wi-Fi, which for most households is a longer list than expected.