A 16-year-old Broadcom WiFi bug lets attackers root routers from across the street
One parser, two bugs, many routers: Exploiting Broadcom WiFi across eCos, Linux
A flaw in Broadcom's proprietary 802.11 WPS implementation, present since at least 2010, allows unauthenticated remote code execution over WiFi without the network key. An incomplete 2018 patch and Broadcom's refusal to assign a CVE left millions of routers exposed. The researcher demonstrated root shells on three of four Belgian ISPs' gateways, including Proximus, VOO, and Orange, with none patched as of October 2026.
This means you can get a root shell from across the street on a significant proportion of routers in Belgium, and probably elsewhere.
- myself248
The article estimates the number of these routers in the author's home country (Belgium), but the vulnerability would exist in units sold worldwide, no? Seems to me that their estimates of affected units are a couple orders of magnitude low.
- userbinator
unless affected Original Equipment Manufacturers (OEMs) are willing to migrate.
...or someone spends a bit of time with an AI to come up with a patch? Bonus points for one that can be remotely installed using the same exploit...