On October 16, 2026, security researcher Quentin Kaiser took the stage at the Hexacon security conference in Paris and demonstrated a striking real-world attack: standing across the street, without entering any Wi-Fi password or completing a handshake, he sent a handful of over-the-air wireless frames toward a consumer gateway. Within seconds, he popped an unauthenticated root shell. The underlying vulnerability was written into Broadcom chipset firmware as far back as 2010, quietly lurking inside hundreds of millions of home routers worldwide for sixteen years. Silicon vendors, original equipment manufacturers (OEMs), and telecom operators each hid behind liability boundaries, creating an intractable logjam in patch propagation. Ultimately, ordinary broadband subscribers bore the brunt of a decade-and-a-half-long supply chain failure.
Packets from Across the Street: Popping Root Without a Password
Most home users assume that configuring a complex Wi-Fi password shields their home network from nearby intruders. Kaiser’s exploit completely circumvents authentication; an attacker does not even need to finish a standard Wi-Fi Protected Setup (WPS) session. As long as radio signals reach across the street, a remote attacker can inject arbitrary frames over the air, read plaintext credentials straight out of device memory, or convert the gateway into a remotely controlled bot.
To assess actual real-world exposure, Kaiser and his collaborators sampled four major Belgian broadband providers. Proximus accounts for 2.318 million subscribers, with an estimated 850,000 active gateways vulnerable (notably BBOX 3 and BBOX3V+ models). In VOO’s legacy fleet, around 500,000 customers running Netgear CG3100 and Technicolor TC7210 hardware were fully exposed. Orange Belgium had roughly 210,000 exposed TCG3000 devices out of 547,000 subscribers, while Telenet (1.758 million subscribers) is still evaluating its Sagemcom gateway footprint. Across just the top three carriers, over 1.56 million residential gateways stood ready to be hijacked by any passerby with a Wi-Fi antenna.
During his live presentation, Kaiser walked through root compromises against two ISP-issued modems. Against an Orange Belgium TCG3000 gateway, he triggered arbitrary remote code execution over the air, dumping the Pre-Shared Key (PSK) directly from Non-Volatile RAM (NVRAM) and transmitting it back over the radio channel to join the local LAN at will. Against a Proximus BBOX3V+ router, he skipped credential theft entirely, delivering a reverse root shell wrapped inside raw 802.11 frames without touching any intermediary internet servers. The home router—long assumed to be a residential network’s first line of defense—has effectively become an unlocked front door that anyone across the street can kick open.
Written in 2010: One Parser Carries Bugs Across Two OS Eras
How could a single software defect span dozens of consumer brands and compromise hundreds of distinct hardware models? The answer lies in the structural division of labor across the telecom hardware supply chain. Router vendors rarely write low-level 802.11 radio handling routines in-house. Instead, they license and bundle binary Software Development Kits (SDKs) provided by upstream silicon vendors like Broadcom. When an architectural flaw exists in upstream code, downstream manufacturers ship it downstream into production firmware without inspection.
Tracing the flaw’s lineage, Kaiser discovered the vulnerable logic had been checked into Broadcom repositories since at least 2010, located inside release/src-rt/wps/common/ap/ap_eap_sm.c. When a router reassembles fragmented Extensible Authentication Protocol (EAP) messages during WPS pairing, the parser fails to properly validate buffer lengths, causing a classic memory buffer overflow. Broadcom initially deployed this proprietary 802.11 protocol stack on the eCos real-time operating system; when engineering workflows later transitioned to Linux, developers ported the flawed parser verbatim.
Figure: Wireless frames pass from the kernel-level wl.ko module up into the user-space wps_monitor daemon; a 2010 flaw was carried intact into modern Linux environments. Source: Quentin Kaiser / Hexacon 2026
On modern Linux-based routers, receiving wireless frames triggers hardware interrupts that feed into the proprietary wl.ko kernel module. Packets travel across Broadcom event sockets into the eapd multiplexer before finally hitting the userland wps_monitor daemon responsible for WPS pairing logic. This setup was the equivalent of erecting a modern steel-and-concrete building while installing a rusty sixteen-year-old lock on the front entrance. Blind reuse of low-level legacy modules allowed a single line of defective code to metastasize into an industry-wide, generational epidemic.
Turning this heap overflow into an exploit required overcoming three separate technical hurdles. Initially, the attacker cannot predict where injected payloads will land in memory; incoming fragments at offset +0x9 must include legitimate WPS opcodes (0x04 through 0x0F); and memory writes consistently land past the frags_received field. By reverse-engineering parser structures, Kaiser assembled three essential exploit primitives: manipulating total_received for arbitrary memory writes, corrupting the next_frag_to_send pointer for arbitrary memory reads, and ultimately hijacking execution by clobbering parse_msg or send_data function pointers.
The resulting exploit chain unfolds like precision surgery across three sequential phases. First, a calibration infoleak determines relative buffer offsets within the active WPS state structure. Second, reading the self-referential next_frag_to_send pointer reveals the absolute virtual memory address of the state object. Finally, overwriting send_data redirects control flow directly into an injected payload the instant the router attempts to transmit a radio response. A meticulously engineered three-stage exploit chain turned what would normally be an unrecoverable kernel panic into a deterministic, silent zero-click takeover.
The 2018 Half-Patch and Millions of Forever-Day Devices
The flaw was not entirely unknown prior to Kaiser’s research. As early as 2018, Broadcom identified the vulnerability and released a private patch upstream. However, that patch did not resolve all code paths; rather than overhaul the legacy stack, Broadcom advised OEMs to abandon its proprietary implementation in favor of the community-maintained open-source hostapd suite.
Figure: Chipset matrix across cable, DSL, and fiber gateways. Legacy eCos platforms on the left remain permanent, unpatchable zero-day targets. Source: Quentin Kaiser / Hexacon 2026
This migration mandate drew an uncompromising fault line through deployed hardware fleets. Newer Linux-based gateways built on BCM65xx and BCM68xx platforms could adopt hostapd, provided OEMs invested engineering hours to refactor their firmware. But for legacy devices powered by BCM3380, BCM3383, BCM3384, or dual-core BCM3390 silicon running eCos, no migration path ever existed. These architectures span DOCSIS cable modems, xDSL/vDSL2 telephone gateways, and xPON fiber terminals—condemning millions of deployed customer devices to eternal “Forever-day” vulnerability status since 2018.
To assess modern street-level deployment, Kaiser performed passive over-the-air scans across Paris. He observed that newer Wi-Fi 6 gateways leveraging BCM68572, BCM68881, BCM6752, or BCM68360 chips generally received adequate patches, whereas older generations remained wide open. Lacking access to internal carrier inventories worldwide, Kaiser cannot quote an exact global count, but extrapolation from European telecom data suggests the population of active, unpatched gateways sits in the “low hundreds of millions.” Hardware vendors avoided ongoing software maintenance by hiding behind architectural obsolescence, handing hundreds of millions of functioning routers a digital death sentence.
Buck-Passing Across the Supply Chain: A 90-Day Disclosure Stalemate
If the danger is this immediate, why do telecom operators still leave millions of exposed devices unpatched eight years after Broadcom’s initial advisory? Kaiser initiated a standard 90-day responsible disclosure timeline in summer 2026, which laid bare the organizational dysfunction paralyzing telecom supply chains. On July 18 and July 27, he submitted vulnerability reports covering eCos and Linux platforms to Broadcom’s security response team (tracked as KS-20260718-02 and KS-20260727-01).
Figure: After silicon vendor patch issuance, only proactive OEMs secured devices by 2026, while channels that ignored notices left devices exposed. Source: Quentin Kaiser / Hexacon 2026
On July 28, Broadcom responded that patches had been available for years, instructing the researcher that if vulnerable end-user modems were found, he should contact router manufacturers directly so they could request upstream fixes. When Kaiser pressed for disclosure specifics the next day, Broadcom declined to assign a Common Vulnerabilities and Exposures (CVE) identifier, and refused to provide documentation proving that security bulletins had ever reached downstream OEMs. On August 4, Kaiser escalated the issue to CERT/CC, only for the coordination ticket to be closed that very same day.
Both sides maintain contradictory positions within industry governance structures. Under current CVE program rules, Broadcom operates as an authorized CVE Numbering Authority (CNA), possessing unilateral discretion over whether to issue identifiers. Broadcom maintains that having issued patches and migration guidance in 2018 satisfied its obligations. Conversely, from the perspective of independent researchers and downstream defenders, withholding a public CVE identifier and coordinated security bulletin severed the primary early-warning mechanism across multi-tiered supply chains. Consequently, dozens of contract manufacturers and internet service providers never knew their production firmware harbored critical remote root flaws.
Blocked upstream, Kaiser spent late summer contacting downstream European ISPs directly, only to be met with bureaucratic inertia. On July 29, he distributed findings and detection tooling to Belgian operators and national cybersecurity authorities. Proximus waited until August 25 to schedule an exploratory call; VOO never responded at all. Orange Belgium’s CISO quietly followed Kaiser on social media on August 18 without submitting any formal technical reply. By the time Kaiser took the stage on October 15, not a single vulnerable subscriber gateway across those carriers had received an over-the-air update. A fragile supply chain lacking mandatory remediation mandates and public vulnerability tracking allowed critical security patches to sit dormant on vendor file servers for eight years.
AI Cracks a 16-Year Black Box in One Week: The Technical Debt Reckoning
Historically, silicon vendors and OEMs could rely on “security through obscurity” because reverse-engineering proprietary wireless firmware was grueling work, often requiring months of specialized reverse-engineering effort. At the conclusion of his report, Kaiser dropped a notable revelation: with the assistance of modern frontier AI reasoning models, he analyzed Broadcom’s closed-source protocol stack, pinpointed the memory corruption primitives, and authored working exploits in under one week. To help the broader community identify exposed infrastructure, he released open-source fingerprinting tools and YARA rules (github.com/qkaiser/broadcom-wps).
Zero-click over-the-air vulnerabilities present catastrophic real-world operational leverage. Advanced persistent threat (APT) groups routinely execute “nearest-neighbor attacks,” compromising consumer Wi-Fi hardware adjacent to target corporate facilities to pivot into internal high-value networks. Similar tactics compromise executive traffic across hotel networks, turning forgotten residential-grade CPE routers into silent proxies. Upstream vendors believed their duties ended with an unheralded 2018 notification, OEMs treated discontinued hardware as someone else’s problem, and ISPs balked at the cost of rolling truck rolls or replacing millions of legacy gateways. Every stakeholder balanced their balance sheet, leaving everyday internet users to shoulder sixteen years of systemic risk.
References:
- Quentin Kaiser Research Paper: One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux
- Hexacon 2026 Presentation Slides: Exploiting Broadcom WiFi Stack Across eCos and Linux
- Open Source Detection Tooling & YARA Rules:
github.com/qkaiser/broadcom-wps- Hacker News Discussion
