Broadcom Wi-Fi WPS EAP reassembly overflow: over-the-air unauthenticated code execution on Broadcom-based ISP gateways, present in the SDK since 2010 and still no CVE
Researcher Quentin Kaiser disclosed on 16 October 2026, at Hexacon in Paris and in a long write-up, a memory-corruption flaw in Broadcom's proprietary 802.11 Wi-Fi stack: an overflow in the reassembly of WPS EAP messages that can be triggered remotely over Wi-Fi without the network key or a completed WPS enrollment, giving controlled information disclosure and arbitrary code execution. He says the bug has been in Broadcom's SDK since at least 2010; Broadcom silently shipped an incomplete patch in 2018 and then advised OEMs to move to hostapd, leaving it a lasting 'forever day' on eCos-based chips (BCM3380, BCM3383, BCM33834) and a potential one on Linux-based chips (BCM3390, BCM65xx, BCM68xx) on any device that was never migrated. Broadcom declined to assign a CVE or publish an advisory, which Kaiser says is why so many OEMs never patched; he reported it under a 90-day timeline that expired on 16 October. He demonstrated working over-the-air exploitation against gateways from three of four Belgian ISPs (Proximus BBOX 3/3V+ Sagemcom F@st, VOO Netgear CG3100/CG3700 and Technicolor/Commscope models, Orange Belgium ASKEY TCG3000), showing a root shell and extraction of the Wi-Fi PSK from NVRAM, and says that as of 15 October none of the demonstrated devices were patched. The same Broadcom silicon ships worldwide in cable and DSL gateways from many vendors, so the blast radius extends well beyond Belgium; Kaiser released a fingerprinting script and a YARA rule to help map affected models. There is no indication of in-the-wild exploitation, and no Australian ISP or device has been named. Primary: Quentin Kaiser research (16 Oct); context: Hexacon 2026 talk.
- Product
- Broadcom 802.11 Wi-Fi SDK (WPS EAP reassembly) on eCos chips BCM3380/3383/33834 and Linux chips BCM3390/65xx/68xx, shipped by many cable and DSL gateway OEMs
- Versions
- Affected: Broadcom's proprietary 802.11 stack as shipped in unmigrated eCos and Linux access-point firmware (bug present since ~2010; incomplete 2018 patch). No CVE assigned; fixed firmware depends on each OEM shipping Broadcom's patch or moving to hostapd.
- Exploited in Australia?
- unknown
- Patch to
- There is no single vendor patch: owners of Broadcom-based cable/DSL gateways should check with their ISP or OEM for firmware that fixes the WPS EAP overflow or moves to hostapd. As interim hardening, disable WPS on the gateway where possible and restrict Wi-Fi exposure; ISPs and OEMs can use Kaiser's published fingerprinting script and YARA rule to identify affected models.