Millions of Broadcom Wi-Fi routers at risk from unpatched flaw

How the flaw works

A security researcher, Quentin Kaiser, has found a flaw in Broadcom's Wi-Fi Protected Setup (WPS) software. This flaw lets an attacker within radio range of a vulnerable router run their own code as the highest-level user (root), without needing the Wi-Fi password or any pairing step. Kaiser showed that by sending specially crafted WPS messages, he could corrupt the router's memory. This allowed him to either read sensitive data from the device or take control of it remotely. In one case, he was able to read the Wi-Fi password off a home gateway and use it to join the network. In another, he opened a remote shell (a command line interface) over the air, all without logging in.

The attack works because Broadcom's WPS code mishandles the way it reassembles fragmented setup messages. This bug has existed since at least 2010. Broadcom tried to fix it in 2018 but only offered an incomplete patch. Instead, the company told customers to switch to a different Wi-Fi software package (hostapd). On some older router models, no fix is possible, making it a so-called "forever day", a flaw that will never be patched.

Who is affected

Kaiser demonstrated the attack on home gateways from three major Belgian internet providers: Proximus, Orange Belgium and VOO. He estimates that hundreds of thousands of routers in Belgium alone are vulnerable. The affected Broadcom chips include older eCos-based models (BCM3380, BCM3383, BCM33834) and newer Linux-based models (BCM3390, BCM65xx, BCM68xx). The list of potentially affected devices is much wider, including routers and access points from brands like Cisco, Huawei and ARRIS, but not all have been confirmed as vulnerable. Some entries are based on automated checks and may only be "likely vulnerable."

Kaiser says millions of devices worldwide could be at risk. The attack does not require physical access, just being within Wi-Fi range is enough. There have been no reports of real-world attacks using this flaw so far; the only working exploits are Kaiser's own demonstrations.

The response

No patch has been released for the affected routers. Broadcom has known about the bug since at least 2018 but has not registered a CVE (Common Vulnerabilities and Exposures identifier) or made a public statement, according to Kaiser. When he contacted the CERT Coordination Center, the case was closed immediately because Broadcom is responsible for assigning CVEs for its products and chose not to do so. This lack of a CVE makes it harder for vendors and defenders to track and respond to the flaw.

Kaiser has published YARA rules (tools for detecting specific code patterns) and a script to help identify vulnerable devices. However, these are only triage aids, a positive result does not guarantee a device is vulnerable, and a patched device may still match the rules. For devices that cannot be fixed, replacement is the only practical option.

What you should do

There is no setting or update that blocks this attack on affected routers. If you manage or use a Broadcom-based router, especially one supplied by a major ISP or made before 2018, check if it is on Kaiser's list or test it using the provided tools. For devices that are confirmed vulnerable and cannot be patched, replacing the router is the safest course.

Source: The Hacker News↗ (opens in a new tab)