Security researcher Quentin Kaiser presented a flaw in Broadcom's Wi-Fi software at the Hexacon conference in Paris on 16 October 2026 and published a full write-up the same day. The bug is in the code that reassembles fragmented WPS (Wi-Fi Protected Setup) EAP messages in Broadcom's proprietary 802.11 stack. An attacker within radio range can trigger it without the Wi-Fi password and without completing a WPS pairing, then read data from the router's memory and run arbitrary code on it.
Which routers
Kaiser traces the vulnerable code in Broadcom's SDK back to at least 2010. Broadcom told him it has known about the bug since 2018, when it replaced the old implementation with one built on hostapd. Kaiser calls that change an incomplete patch released silently. On cable modems running eCos (BCM3380, BCM3383, BCM33834) there is no fix and, in his view, there never will be. On Linux chips (BCM3390, BCM65xx, BCM68xx) a fix depends on the device maker moving to the hostapd-based stack.
He showed working exploits on boxes from three of Belgium's four large ISPs: Proximus (BBOX 3V+), VOO (Netgear CG3100 and CG3700, Technicolor TC7210, CGA4233) and Orange Belgium (Askey TCG3000). In one demo the payload reads the Wi-Fi key from the router's memory and sends it back over the air. In another he opens a remote shell over 802.11 frames. He says the attack also works over long distances. As of 15 October none of these devices had been patched, and his estimate, which he rates at medium confidence, is at least 1.5 million affected routers in Belgium alone.
The device list in his GitHub repository goes well beyond Belgium, and Kaiser stresses that it is not exhaustive. It names hardware from Cisco, TP-Link, Huawei, Netgear, Sagemcom, Zyxel, ZTE and others, deployed by ISPs such as KPN, Movistar, SFR and Türk Telekom. Nokia fibre terminals (G-140W-H, G-2426G-A and several G-240W models) are marked as confirmed, and the operators listed for them include Inea. A passive scan in Paris found an Orange Livebox 5 (Sagemcom Fast5656) and SFR NB6VAC boxes unpatched. The Livebox 6 and a Bouygues Wi-Fi 7 Bbox, both on newer chips, were patched.
No CVE
Kaiser reported the bug to Broadcom in July. Broadcom answered that a patch exists and that if he finds affected devices, he should tell the manufacturers to contact Broadcom. It refused to assign a CVE or to share the notice it sent to manufacturers, and CERT/CC closed his case the same day because Broadcom is its own CVE numbering authority. Kaiser thinks the missing CVE is probably why so many manufacturers never shipped the fix.
What you can do
Kaiser has not released exploit code. He did publish a script that fingerprints a live access point (it needs a Wi-Fi adapter with monitor mode) and YARA rules for scanning firmware images. If the router came from your ISP, compare its model with the list and ask the ISP whether its firmware is fixed. Kaiser does not say whether switching off WPS in the router settings blocks the attack, so don't treat that as protection. The JDNEER points out that turning off the ISP router's own Wi-Fi and using a separate access point removes the radio path, if the ISP allows it.
For a smart home the risk is concrete: with the key pulled out of the router, an attacker joins the same network as the cameras, plugs and the Home Assistant server.