Broadcom Wi-Fi vulnerability leaves over 1.5 million Belgian gateways exposed

What it is

A buffer overflow in Broadcom's SDK, in the WPS code that reassembles fragmented EAP messages. It gives an attacker within Wi-Fi range unauthenticated code execution, with no user interaction. The page says the flaw dates to at least 2010. Quentin Kaiser of ONEKEY found it and demonstrated it at Hexacon in Paris on 16 October 2026. Broadcom refused to assign a CVE, so there is no identifier to track.

Preconditions / Affected

The attack bypasses WPA2 and WPA3 passwords because WPS lets devices join without the key. The page says this does not make those protections useless.

Affected platforms:

• eCos devices using BCM3380, BCM3383 and BCM33834.
• Linux devices using BCM3390, BCM65xx and BCM68xx.
• Both ARM and MIPS hardware.

The affected chips are in hundreds of products worldwide. The Belgian estimate of more than 1.5 million gateways is a market figure, not a global count: about 850,000 Proximus, 500,000 VOO legacy and 210,000 Orange Belgium.

How it works

Kaiser's demonstrations used two gateways:

• ASKEY TCG3000 (Orange Belgium): the Wi-Fi key was extracted in cleartext from NVRAM, then used to join the network.
• Sagemcom F@st/BBOX3V+ (Proximus): a remote shell was opened using only 802.11 frames, with no internet-reachable command server.

The antennas sat close together in the videos because of the test bench. Kaiser says the attack works at any distance within Wi-Fi range.

What to do

The page lists three countermeasures:

• Disable WPS in the router settings.
• Change default administrator credentials.
• Check for operator-supplied firmware updates.

For detection, Kaiser published a fingerprinting script and a YARA rule to identify affected devices. The page does not give a link or file name for either.

Caveats

Broadcom's 2018 patch was incomplete. It later advised switching to hostapd instead of fixing its own code, which leaves eCos platforms effectively unpatchable. When contacted in July 2026, Broadcom said a patch existed and told manufacturers to apply it directly. CERT/CC opened and closed its case in one day.

The 90-day disclosure window ended on 15 October 2026. No surveyed Belgian device had been patched by then, and no complete fix exists. Since the main mitigation depends on operator firmware that has not shipped, disabling WPS is the only step an owner can take now. The page does not say whether disabling WPS fully blocks the vulnerable code path.