Broadcom Wi-Fi vulnerability (WPSplinter): an attacker parked outside is enough
A car has been parked outside your office for twenty minutes. The driver has a laptop on their knees. They don’t know your Wi-Fi password and don’t need it: your router is going to open the door by itself.
That’s the scenario behind the Broadcom Wi-Fi vulnerability presented on October 16, 2026 at the Hexacon conference in Paris by researcher Quentin Kaiser. Nicknamed WPSplinter, it affects the legacy implementation of WPS (the “push a button to connect a device” feature) in Broadcom Wi-Fi chips, used by dozens of manufacturers. And for some of those devices, there will never be a fix.
How the Broadcom Wi-Fi vulnerability is exploited, from the street to the router
In the street or parking lot
The attacker only needs to be within range of your Wi-Fi: a laptop in a car parked out front is enough. No Wi-Fi password needed.
In the Wi-Fi signal
They send deliberately malformed WPS messages (the “push to connect” feature), before any normal connection even starts.
Inside the router
Memory overflows: they can read data from the device or run their own code on it. In a demo, the researcher pulled the Wi-Fi password and joined the network.
Once the router is under control, everything passing through it is within reach: your workstations’ traffic, your printers, sometimes your file server. The researcher hasn’t reported any real-world attacks so far, but estimates that about 1.56 million routers could be affected in Belgium alone.
Small-business models are on the list
This isn’t only about European internet providers. The list published by the researcher, which he himself calls incomplete, includes brands sold everywhere, including Cisco routers and access points designed for small businesses.
| Manufacturer | Models listed (excerpt) | Status per the list |
|---|---|---|
| Cisco (small business) | RV110W, RV130W, RV215W, RV340W routers; WAP121, WAP125, WAP150, WAP361, WAP371, WAP571, WAP571E, WAP581 access points | Confirmed |
| TP-Link | Archer C3150, Archer C5400, VR600, VR900, VR1600, VR2800 | Confirmed |
| ARRIS | SURFboard AC1200 | All listed versions |
| Netgear | CG3100, CG3700B (cable modem-routers) | Confirmed |
| Nokia, ZTE, Sagemcom | Gateways supplied by internet providers (G-240W, F680, F@ST…) | Confirmed, firmware varies |
| Huawei, Tenda | B310, B315, B593, WS880; D301, N300 | Reported, to be verified |
Excerpt from the public WPSplinter list. According to the researcher, a Broadcom chip doesn’t mean a device is vulnerable, and a listed model can vary by hardware revision and firmware.
What we know, what we don’t
✔️ What we know
- The flaw is in the WPS handling of Broadcom’s legacy Wi-Fi stack (eCos and Linux).
- It can be triggered remotely over Wi-Fi, without the network password.
- Working exploits were demonstrated on gateways from three of Belgium’s four major internet providers.
- eCos platforms (BCM3380, BCM3383, BCM33834) have no planned fix: a “forever day” flaw.
❓ What we don’t know yet
- How many devices are affected in Canada: the list is incomplete and no Canadian provider appears on it so far.
- Whether turning off WPS is enough: the researcher advises not to assume so.
- Whether attackers are already exploiting it: no real-world attacks have been reported.
- Which manufacturers will release fixed firmware, and when.
Your router: three cases, three answers
The real issue: your router has an expiry date
Broadcom declined to assign a CVE number, which partly explains why so many manufacturers fixed nothing: without a number, the flaw shows up in no tracking tool. If your device is no longer supported by its manufacturer, no fix is coming. A router is like a firewall: it has an end of life, and that date should be written down somewhere, as we saw with FortiBleed and Fortinet firewalls.
Second lesson: the Wi-Fi password isn’t a strong enough boundary. In the demo, it was read straight out of the router’s memory. What really protects you is separation: guest Wi-Fi apart, connected devices apart, and a firewall between the Wi-Fi and what matters.
5 questions to ask your internet or IT provider this week
- ❓ What is the exact model and firmware version of our router and Wi-Fi access points?
- ❓ Are these devices affected by the WPSplinter flaw, and is a fix planned?
- ❓ Until when will the manufacturer provide updates for these devices?
- ❓ Is our guest Wi-Fi truly separated from our workstations, printers and servers?
- ❓ If someone got our Wi-Fi password tomorrow, what could they reach?
At NeoTech, our business network support keeps an inventory of your equipment and its end-of-support dates, and our automated 24/7 monitoring with on-call technician response flags an unknown device joining your network. See also our cybersecurity services.
Book your free cyber check
Not sure which router or Wi-Fi access point serves your office, or whether it still gets updates? The free cyber check does that inventory with you, checks what separates your Wi-Fi from your workstations and servers, and tells you what to replace first.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- WPSplinter: public page for Quentin Kaiser’s research (device list and FAQ)
- Quentin Kaiser: One Parser, Two Bugs, Many Routers (October 16, 2026)
- The Register: Broadcom Wi-Fi bug turns sweet 16, still lets strangers hijack your router (October 19, 2026)
Photo: Jakub Zerdzicki, Pexels (Pexels licence).