16-Year-Old Broadcom Wi-Fi Bug Exposes Routers With No Password

Root access from across the street

The vulnerability lurks inside Broadcom's legacy WPS Monitor, the background module handling Wi-Fi Protected Setup connections. When incoming WPS messages arrive in fragments, the parser stitches them together without checking buffer limits, triggering a buffer overflow.

Security researcher Quentin Kaiser revealed at the Hexacon conference that an attacker can exploit this flaw before any pairing handshake completes. No WPA passphrase, PIN, or physical button press is required.

In tests on ISP gateways, Kaiser extracted plaintext network passwords from an Askey TCG3000 and launched an unauthenticated root shell over raw wireless frames on a Sagemcom BBOX3V+. The exploit works from a distance, giving anyone parked outside direct access to the router.

The patch that never reached living rooms

When Kaiser alerted Broadcom in July 2026, the chipmaker admitted it had known about the bug since 2018. Broadcom's actual remedy back then was replacing WPS Monitor with hostapd in newer SDKs, leaving older products stranded.

Broadcom declined to assign a CVE identifier, calling the software obsolete. Because Broadcom acts as its own CVE Numbering Authority, that decision effectively buried public tracking.

For chipsets built on the eCos operating system—including the BCM3380, BCM3383, and BCM33834—there is no hostapd migration path. Kaiser labels these forever-day vulnerabilities. Linux-based chips like the BCM63xx can run newer code, but only if manufacturers invest in backporting fixes to retired gear.

Why changing passwords will not stop the Broadcom Wi-Fi flaw

Standard defensive measures offer no protection against WPSplinter.

Changing your Wi-Fi password does nothing because the exploit runs before login checks. Turning off WPS in the web portal may also fail, as many consumer firmwares leave the parsing daemon listening on the radio interface regardless.

Similar to how the abandoned Popcorn Time app exposed millions to hijack attacks, unmaintained networking code lingers silently in home devices long after suppliers stop caring.

Unless an ISP issues a firmware update that strips the daemon, the only fix is replacing the hardware entirely.

Availability and pricing

Broadcom chips power millions of broadband gateways distributed by major carriers across the US, UK, and Europe, including Sagemcom and Technicolor modems. Subscribers using rented equipment should ask their providers whether their gateway still runs legacy Broadcom code.

If you own an unsupported third-party router from the mid-2010s, replacement is your only realistic solution.

With attackers frequently hunting perimeter targets, leaving millions of residential gateways unpatched creates an open door that will persist until the physical hardware is thrown away.