WPSplinter: a 16-year-old flaw in Broadcom’s Wi-Fi SDK lets anyone in range run code on your router

Network security talk usually centers on perimeters, firewalls, and cryptographic handshakes, and a strong WPA3 passphrase feels like enough to keep outsiders away. The code underneath often tells a different story, because much of it has been sitting in routers for over a decade. At Hexacon 2026 in Paris, security researcher Quentin Kaiser presented WPSplinter, a vulnerability in Broadcom’s proprietary Wi-Fi software development kit that has been there since at least 2010. An attacker within wireless range can execute arbitrary code on a vulnerable router without knowing the network password and without completing Wi-Fi Protected Setup (WPS) enrollment.

Most Wi-Fi attacks go after weak passwords or captured handshakes cracked offline. WPSplinter sits where wireless protocol processing meets low-level memory management. WPS was designed to simplify onboarding, and it uses the Extensible Authentication Protocol (EAP) to carry provisioning messages between an enrollee and a registrar. 802.11 frames have strict size limits, so these EAP-WPS messages are often fragmented and the access point has to reassemble them. A sound implementation tracks how much data has arrived, validates fragment boundaries, and enforces the capacity of the destination buffer. Broadcom’s legacy WPS Monitor does not constrain the reconstructed message to the available buffer, so carefully crafted, oversized fragments trigger a textbook buffer overflow.

On embedded devices, memory corruption is often written off as a reliability problem that ends in a kernel panic or a crashed service. Kaiser showed that WPSplinter can be turned into a reliable chain that ends with root privileges. It starts with an information leak: the overflow is manipulated to send memory contents back to the attacker over the wireless link. That data reveals the target’s memory layout, processor architecture, and internal program state, which removes most of the guesswork usually involved in exploiting embedded hardware. With that map, the attacker moves to arbitrary code execution. Kaiser demonstrated two outcomes against production gateways deployed by Belgian ISPs. On an ASKEY TCG3000 gateway used by Orange Belgium, the exploit read the Wi-Fi pre-shared key straight out of the device’s non-volatile RAM (NVRAM), so there was no password to crack. On a Sagemcom BBOX3V+ used by Proximus, he opened an interactive reverse shell whose command-and-control traffic ran entirely over 802.11 frames. That means a persistent foothold with no connection to the wider internet.

The disclosure timeline is where the supply chain problem shows. According to Kaiser, Broadcom was notified and said a patch was available by July 2026. It then recommended that manufacturers drop the proprietary WPS Monitor in favor of the open-source hostapd daemon. Broadcom also declined to assign a Common Vulnerabilities and Exposures (CVE) identifier, arguing that the affected software was obsolete. A component-level fix does little for the millions of routers already installed in homes and offices. The flaw spans several system-on-chip families, and what happens next depends on the operating system. Linux-based platforms using chipsets like the BCM3390 or BCM68xx series can in theory be patched or moved to hostapd, if the device manufacturer does the work of integrating, testing, and shipping new firmware.

Devices built on eCos are in far worse shape. That covers the BCM3380, BCM3383, and BCM33834 families. Kaiser calls these legacy cable gateways “forever day” devices because there is almost no practical path to a full fix. eCos is a specialized embedded operating system that leans on proprietary drivers, tightly integrated firmware, and development environments the silicon vendor often no longer maintains. Swapping out the vulnerable networking stack means re-engineering the device’s core functionality, not dropping in a patched binary. If the manufacturer has moved on to newer hardware revisions, Broadcom’s source-level correction protects no one. Physical replacement is the only reliable remedy, and that is expensive and logistically painful for ISPs running fleets of hundreds of thousands of gateways.

Finding out whether you are exposed takes more than a standard vulnerability scanner, since there is no official CVE for scanners to key on. Kaiser has released a detection toolkit with YARA rules for static firmware analysis and a Python wireless fingerprinting script. The YARA rules match ELF binaries and instruction patterns tied to the vulnerable reassembly path on ARM and MIPS, so organizations can screen their firmware inventories for the legacy WPS Monitor component. The fingerprinting script analyzes live 802.11 traffic for Broadcom-specific information elements and behavioral quirks that separate the vulnerable legacy parser from modern hostapd. Turning off WPS in the router’s admin interface is not a confirmed mitigation. The vulnerable parser handles pre-association frames before the normal WPS enrollment workflow starts, so malicious input reaches the flawed code whatever the user-facing setting says.

WPSplinter also changes where the network perimeter sits. Security strategies tend to focus on internet-facing services and assume that a device behind NAT with a strong Wi-Fi password is safe from outside interference. Kaiser’s work shows the risk from “nearest-neighbor” attacks, where an adversary works from a parked car, an adjacent apartment, or a shared office hallway. Once the gateway is compromised, it becomes a pivot point instead of a protective boundary. A subverted router can intercept internal traffic, manipulate DNS responses, alter firewall rules, and attack connected endpoints that implicitly trust the local gateway. Wireless infrastructure deserves the same scrutiny as public-facing cloud servers: strict inventory management, continuous monitoring, and firm lifecycle policies.

The flaw lived in a proprietary, little-examined corner of the wireless stack, and it survived sixteen years of firmware updates and security audits. The missing CVE adds friction to remediation, since defenders have to rely on manual verification and researcher-maintained inventories. A strong password does nothing against a bug in code that runs before authentication.