A vulnerability affecting Broadcom’s proprietary implementation of 802.11 has been present in their SDK since at least 2010. An incomplete patch was silently released in 2018, followed by Broadcom’s r

Repartage — contenu de Quentin Kaiser

A vulnerability affecting Broadcom's proprietary implementation of 802.11 has been present in their SDK since at least 2010. An incomplete patch was silently released in 2018, followed by Broadcom's recommendation to move to hostapd instead, making it a definitive forever day on eCos-based platforms (BCM3380, BCM3383, BCM33834) and a potential forever day on Linux platforms (BCM3390, BCM65xx, BCM68xx) unless affected Original Equipment Manufacturers (OEMs) are willing to migrate.

The vulnerability can be triggered remotely over WiFi without knowledge of

the network key or completion of a normal WPS enrollment. Exploitation provides

controlled information disclosure and arbitrary code execution.

It affects dozens of vendors, hundreds of products, and millions of Broadcom-based access points worldwide. In an effort to discover all affected vendors and devices, I'm providing a fingerprinting script and YARA rule at https://lnkd.in/e4yC6tx8 so you can help me document the

blast radius.

According to Broadcom's own response, they've known about the bug since 2018 and they've received information about it from other external entities. Yet they

refused to assign a CVE to this vulnerability or to communicate publicly about it which is probably the reason why so many OEMs did not patch.

I demonstrated that the vulnerability is present and exploitable on 3 out of 4

Belgian Internet Service Providers including Proximus (BBOX 3V+), VOO (Netgear CG3100, Netgear CG3700, Technicolor 7210, CGA4233) and Orange (ASKEY TCG3000). Telenet may be affected through Sagemcom F@st devices, but I could not get my

hands on one.

As of October 15th, 2026, none of these affected devices have been patched. This

means you can get a root shell from across the street on a significant proportion of routers in Belgium, and probably elsewhere.

In this video, I demonstrate remote unauthenticated code execution fully over-the-air including the interactive shell.

265

16

26

265 reactions

Sources LinkedIn

• Conversation LinkedIn : voir la publication
• Profil : Pierre Jean Duvivier dit Sage (LinkedIn)
• Auteur partagé : Quentin Kaiser (LinkedIn)