Security researcher Quentin Kaiser has disclosed a 16-year-old vulnerability in Broadcom's Wi-Fi Protected Setup (WPS) implementation that lets an attacker within radio range run code on a router without knowing the Wi-Fi password. Dubbed WPSplinter in The Register's report, the bug stems from improper reassembly of fragmented WPS messages, which corrupts router memory and can be exploited to read data or execute arbitrary code. Both sources agree that no CVE has been assigned and no fix has been deployed to affected devices.
Kaiser demonstrated working exploits against gateways from three Belgian internet providers. On an Askey TCG3000 supplied by Orange Belgium, he pulled the Wi-Fi password from memory and used it to join the network; against a Proximus Sagemcom BBOX3V+, he opened a reverse shell carried over Wi-Fi frames. The Hacker News notes that the attack works at a distance and requires no login or pairing step. The Register adds that Kaiser credited AI models with compressing months of work into under a week.
Broadcom reportedly knew about the flaw in 2018 and shipped an incomplete fix before recommending that manufacturers move to the open-source hostapd software. Older eCos-based chips such as the BCM3380, BCM3383, and BCM33834 are unlikely to ever be patched, which Kaiser calls a 'forever day.' Newer Linux-based chips could be fixed if vendors switch Wi-Fi software. The Register estimates 1.56 million affected routers in Belgium alone; The Hacker News says the wider list of affected vendors includes Cisco, Huawei, and ARRIS, though some entries are only 'likely vulnerable.'
The two reports differ mainly in emphasis: The Register names the bug WPSplinter and highlights the AI-assisted investigation, while The Hacker News provides concrete detection aids, including YARA rules for firmware and a script that checks live access points. Both agree there is no evidence of real-world exploitation yet, and that replacing unpatched hardware is the practical option for devices that will never receive a fix.