One parser, two bugs, many routers: Exploiting Broadcom WiFi across eCos, Linux

What it is

A WPS EAP reassembly overflow in Broadcom's proprietary 802.11 stack, found by Quentin Kaiser and presented at Hexacon in Paris on 16 October 2026. The page says the bug has been in Broadcom's SDK since at least 2010. Broadcom released an incomplete patch in 2018 without announcement and then recommended moving to hostapd. Broadcom has refused to assign a CVE, so there is no identifier to track it by. The report IDs are KS-20260718-02 (BCM3380, BCM3383, BCM33834) and KS-20260727-01 (BCM3390, BCM65xx, BCM68xx).

Preconditions / Affected

• The attacker needs only radio range. The network key is not needed, and a normal WPS enrollment does not have to complete.
• The author calls it a definitive forever day on eCos platforms (BCM3380, BCM3383, BCM33834). On Linux platforms (BCM3390, BCM65xx, BCM68xx) he calls it a potential forever day, unless OEMs migrate to hostapd.
• Confirmed exploitable devices in Belgium:
• Proximus: BBOX 3V+ (Sagemcom F@st).
• VOO: Netgear CG3100, Netgear CG3700, Technicolor 7210, CGA4233.
• Orange: ASKEY TCG3000.
• Telenet may be affected through Sagemcom F@st devices, but the author could not obtain one to test.
• As of 15 October 2026, none of these devices had been patched. The author says dozens of vendors and hundreds of products are affected worldwide.

What it gives an attacker

The page demonstrates controlled information disclosure and arbitrary code execution without authentication. In the Orange demo, shellcode reads the PSK from NVRAM and sends it back over 802.11, and the author then joins the network with it. In the Proximus demo, a reverse shell runs over 802.11 frames, so no cloud C2 is needed. The author says the attack works over long distances.

What to do

• Broadcom told the author on 28 July 2026 that a patch exists. Affected OEMs must obtain it through the Broadcom Customer Portal, and Broadcom would not share its OEM notification.
• The author provides a fingerprinting script and a YARA rule to help identify affected vendors and devices. Both are linked from the post, and the page text here does not reproduce them.
• The page names no workaround for deployed devices. The patch is incomplete for the 2018 fix, and no ISP firmware fix is reported.
• Disabling WPS is not mentioned as a mitigation, so the page gives no support for it.

Disclosure timeline

The 90-day clock started on 18 July 2026 and ran to 16 October 2026.

• 29 July 2026: Broadcom refused to register a CVE. The author reported to Proximus, tried to contact Orange Belgium and VOO, and sent the report and toolkit to the Cyber Security Center Belgium.
• 4 August 2026: a CERT/CC VINCE case was closed the same day, because Broadcom is a CNA and would not register a CVE.
• Orange Belgium never answered. Proximus asked for the full report and held a follow-up call on 25 August 2026.

Caveats

• The affected-device estimates come from IBPT data and ISP announcements. The author rates them medium confidence.
• The author has no information on what vendors or ISPs have done since the report.
• The post says AI frontier models cut the research to under a week. It gives no method detail, and the slides carry the exploitation primitives and chaining.