Unpatched Broadcom Wi-Fi Vulnerability Lets Attackers Execute Code on Routers

Security researcher Quentin Kaiser disclosed an unpatched vulnerability in Broadcom Wi-Fi setup software in October. The flaw affects home routers and gateways supplied by internet service providers, including models distributed by at least three Belgian ISPs. The vulnerability permits an attacker with physical proximity to the device to execute code with root privileges, bypassing the need for network credentials or any authentication step. In his proof of concept, Kaiser demonstrated the ability to extract the Wi-Fi password directly from the device's memory.

The vulnerability exists in the device setup or provisioning mechanism that Broadcom Wi-Fi systems use. Unlike typical network attacks that require password knowledge or connection to the network, this flaw allows an attacker within radio range to interact with the device at a lower level, before the normal Wi-Fi authentication layer. The attacker does not need to be connected to the network or to know the password. Once access is achieved, the attacker runs code as root, the highest privilege level on the device, granting complete control over router settings, traffic logging, DNS hijacking, and credential theft.

A compromised router becomes a persistent foothold in your home or office network. Unlike a PC that you can reboot or reinstall, a router sits between your internet connection and every device connected to it, making it an ideal target for long-term surveillance or data interception. An attacker with root access can monitor all internet traffic passing through the device, intercept credentials sent over HTTP, redirect DNS queries to fake servers, or inject malware into downloads. This matters more than a single compromised laptop because the router affects every phone, laptop, and smart device on the network simultaneously.

Your risk depends on three factors: whether your router uses Broadcom Wi-Fi hardware, whether it remains unpatched, and whether an attacker has physical proximity to your location. Broadcom supplies Wi-Fi chipsets to many consumer router brands, but not all models are affected by this particular flaw. ISP-supplied gateways are especially risky because users rarely have direct control over firmware updates; the ISP must release and deploy patches. Researchers have demonstrated the attack against specific Belgian ISP models, but the vulnerability may affect other Broadcom-based routers worldwide. An attacker must be within Wi-Fi radio range, typically 100 to 300 meters outdoors or through buildings, depending on antenna power and the environment.

Several factors allow unpatched vulnerabilities to linger in routers. Hardware manufacturers often stop supporting older models before patches are released for newly discovered flaws. ISPs may deprioritize updates for consumer devices if no active exploit campaign is reported. Unlike phones or computers where users regularly check for updates, most people never inspect their router settings or firmware version. The vulnerability is unpatched as of the disclosure date, meaning Broadcom had not yet released a software fix available to the public. Affected users have limited options: wait for their ISP to release an update, or replace the device entirely.

You cannot detect whether an attacker has compromised your router through normal means because root-level access allows an attacker to hide traces. However, you can reduce your immediate exposure by taking these steps:

1. Check your router's administrative interface for the manufacturer and model number, usually found on a label on the device itself.
2. Visit the manufacturer's support website and enter your model to check the latest firmware version.
3. Compare your current firmware version (found in the router's settings menu under System or Administration) with the latest version available.
4. If a newer version exists, apply the update immediately through your router's web interface or mobile app.
5. If your router is supplied by your ISP and you cannot update it yourself, contact your ISP's support line and ask whether a patch is available for your device model.
6. If no patch is available and the device remains unpatched after 30 days, consider requesting a replacement from your ISP or purchasing a supported alternative.

This disclosure reflects a wider pattern: network devices like routers, switches, and modems receive less security scrutiny and slower patch cycles than consumer software. Public disclosure of such flaws often triggers a race between defenders installing updates and attackers exploiting the gap. Researchers avoid publishing attack code immediately, but once a flaw is public, motivated attackers can reverse-engineer it within weeks. ISPs and manufacturers face pressure to update millions of deployed devices, a logistical challenge that often takes months. Users in the meantime remain exposed if they are within range of a local attacker.

Check your router model today and determine whether a firmware update is available. If your device is an ISP-supplied gateway, contact your provider directly and ask for the status of any Broadcom Wi-Fi security patches relevant to your model. If no update exists and the device is old, this may be the time to request a replacement or to invest in a newer router with active manufacturer support. The goal is not to panic but to act with the same urgency you would apply to a known vulnerability on your laptop or phone, because your router's security affects every connected device in your home.

Can this attack work through my walls or from the street outside my house?

Yes, the attacker only needs to be within Wi-Fi radio range. The attack exploits the Wi-Fi setup mechanism itself, not the encrypted network channel, so walls or distance degrade the signal but do not stop the attack entirely. A determined attacker with directional antennas could potentially target a router from dozens of meters away.

Do I need to know the Wi-Fi password to exploit this flaw?

No. The vulnerability exists in the provisioning layer that precedes normal Wi-Fi authentication. An attacker does not need to connect to your network or know your password.

If my router is patched, am I completely safe?

This specific flaw would be closed by a patch, but routers often have multiple vulnerabilities. A patch for one issue does not guarantee immunity to all others. Keep your firmware updated and monitor security advisories from your manufacturer or ISP.

What can an attacker do with root access on my router?

An attacker with root access can intercept all internet traffic on your network, extract stored Wi-Fi passwords, modify DNS settings, inject malware, create a backdoor for persistent access, or monitor which websites and services you use.

How do I know if Broadcom is in my router?

Check your router's specifications or model number on the manufacturer's website. The chipset is often listed under Technical Details or System Specifications. ISP-supplied devices may not publish this information online, so contact your ISP directly.

Source: The Hacker News