Millions of Older Routers May Be Vulnerable to a Nearby Wi-Fi Takeover Flaw

What is the Broadcom WPS router vulnerability?

The Broadcom WPS router vulnerability is a pair of flaws in Broadcom’s proprietary 802.11 and WPS implementation that can let a person nearby attack a vulnerable router over Wi-Fi. Quentin Kaiser publicly disclosed the issue on October 16, 2026, after presenting the research at Hexacon in Paris, and calls the public disclosure WPSplinter. Kaiser’s technical disclosure describes the affected code and the attack conditions.

The risk is serious because the attacker does not need to know the network’s wireless password or finish a normal WPS enrollment. Kaiser says the flaws can produce memory disclosure and arbitrary code execution, which means an attacker may be able to expose information stored in memory or run code on the affected device. The practical limit is physical proximity: the attacker needs to be within Wi-Fi range of the router.

Broadcom WPS router owners should treat the issue as a router-security problem rather than a password-only problem. Changing a Wi-Fi password does not remove a flaw that can be reached without that password. Disabling WPS and checking the router maker’s support page for firmware remain the sensible first actions.

How serious is a nearby Wi-Fi router takeover attack?

A nearby Wi-Fi router takeover attack can be high risk because the router manages traffic for every device connected to the home or small-business network. Arbitrary code execution on a router could give an attacker a foothold on the network device itself, while memory disclosure could expose information handled by the vulnerable process. The disclosed attack requires Wi-Fi proximity, which reduces remote exposure but does not make the flaw harmless.

The most important point is that a locked wireless network is not necessarily protected against this specific attack path. Kaiser says WPSplinter can be triggered without the Wi-Fi password and without completing normal WPS enrollment. Owners should therefore avoid assuming that a strong wireless password resolves the disclosed weakness.

Router flaws also deserve attention because older networking equipment often remains deployed after software support has slowed or ended. The broader concern around router security is not limited to one vendor, as shown by recent scrutiny of router security claims. For this Broadcom issue, owners should identify the exact router model and firmware before deciding whether a patch, configuration change, or replacement is necessary.

Which routers are known to be affected by WPSplinter?

The confirmed WPSplinter list includes the ARRIS SURFboard AC1200, AT&T’s ARRIS BGW210-700, and Cisco RV110W, RV130W, RV215W, and RV340W models. Kaiser’s toolkit emphasizes that the device list is incomplete and could ultimately cover thousands of products because Broadcom code has appeared in many router designs. The researcher’s device toolkit and known-device list provides the current confirmed entries.

The Broadcom WPS router vulnerability should not be treated as confirmation that every router using a Broadcom chip is vulnerable. The relevant issue is the presence of affected proprietary SDK components and the specific firmware revision installed on the device. A router can contain Broadcom hardware without matching a currently confirmed product or firmware build.

The table below separates the disclosed, confirmed models from the broader population that still needs vendor or firmware-specific confirmation.

How can router owners check whether a device needs attention?

Router owners should begin by identifying the exact model number, the installed firmware version, and whether WPS is enabled in the router’s administration interface. The model number is usually printed on the router label, while firmware information is commonly shown in the device’s system or administration pages. Record those details before changing settings so vendor support can identify the correct update path.

Kaiser’s toolkit includes YARA rules for examining extracted router firmware and a live Wi-Fi fingerprinting script. Those tools are intended for technical triage, not definitive proof for every firmware revision, because router makers can modify software and ship different builds over a product’s lifespan. Most home users should not attempt firmware extraction or specialized Wi-Fi testing unless they understand the risks.

Home users can take a more practical route by checking whether their exact model appears in the researcher’s list, reviewing the router maker’s support material, and looking for a current firmware release. Keep router administration credentials private and avoid downloading firmware from unofficial forums or file-sharing sites. A compromised update package can create a separate security problem, similar to the risk highlighted when software update servers were hijacked.

What should owners do to reduce the WPSplinter risk?

Broadcom WPS router owners should disable WPS first if their router interface provides that setting. The disclosed attack targets Broadcom’s proprietary WPS-related implementation, so turning off the feature removes the most direct exposed service described in the research. Disabling WPS can make connecting some devices less convenient, but it is a reasonable tradeoff while patch availability remains uncertain.

1. Identify the router’s exact model number and installed firmware version.
2. Open the router administration interface and disable WPS if the setting is available.
3. Check the router maker’s official support page for firmware updates or security notices.
4. Install an official update after confirming that it matches the exact router model.
5. Replace the router if the manufacturer no longer provides updates and WPS cannot be safely disabled.

Back up or record important router settings before changing the configuration, because a reset or incorrect firmware file can interrupt internet access and require setup again. The practical response is to use only firmware supplied by the router maker or internet provider. Stop and contact the device maker, internet provider, or a qualified network professional if an update fails, the router becomes unreachable, or the available firmware instructions do not clearly match the model.

Have vendors released patches for the Broadcom WPS flaw?

Patch availability remains uneven and uncertain for many affected products. Kaiser says Broadcom’s vulnerable SDK code has existed since at least 2010, that an incomplete patch arrived in 2018, and that a newer SDK replaced the affected components with hostapd. The presence of a newer SDK does not confirm that every older router received an update from its manufacturer.

Kaiser also says Broadcom declined to assign a CVE or issue public communication, despite telling him that it had known about the bug since 2018. The lack of a CVE can make it harder for ordinary owners to find model-specific advisories, which increases the importance of checking the router manufacturer’s support information directly.

By October 20, 2026, Kaiser said Proximus had disabled WPS across its BBox fleet and expected to fully patch the fleet in coming weeks. Orange Belgium was still investigating, while Telenet was not affected, according to the disclosure. Owners whose router comes from an internet provider should ask the provider whether it manages firmware remotely and whether WPS has been disabled.

Why do older routers face the greatest uncertainty?

Older routers face the greatest uncertainty because the vulnerable Broadcom SDK components may remain embedded in products long after the original code was written. Kaiser says the affected code dates to at least 2010, while the confirmed device list remains incomplete. That combination makes a product’s age and support status important factors when assessing risk.

The Register reported on October 19, 2026, that the flaws date to at least 2010 and that devices identified by Kaiser had not received a patch as of October 15. Independent reporting on the disclosure adds context on the patch gap affecting identified devices.

For most households, replacing a router is appropriate when the manufacturer no longer publishes firmware, the provider will not update the device, or WPS cannot be disabled. A newer router does not automatically guarantee protection, but active vendor support gives owners a clearer path to receive a fix when security flaws emerge.

What does the incomplete device list mean for router owners?

The incomplete WPSplinter device list means owners should not use the absence of a model name as proof that a router is safe. Kaiser’s toolkit identifies confirmed products, but the researcher warns that the list may eventually include thousands of devices. The list is useful for prioritizing checks, not for issuing a final verdict on every Broadcom-based router.

Router owners should focus on support status and exposed features rather than waiting for every possible model to be cataloged. Disabling WPS, applying official firmware, and replacing unsupported equipment reduce risk even when a model has not been confirmed. Those actions also improve resilience against future router flaws that use different attack paths.

The most sensible approach is to document the router model now and set a reminder to review manufacturer notices. Security updates should be treated as part of normal device maintenance, much like installing browser patches after a critical Chrome security update. The key difference is that unsupported routers may have no update path, which makes replacement the safer long-term option.

FAQ

Can someone exploit the Broadcom WPS router vulnerability without my Wi-Fi password?

Yes, the disclosed WPSplinter attack can be triggered by someone within Wi-Fi range without knowing the wireless password or completing normal WPS enrollment. Disabling WPS is the immediate mitigation while you check for an official firmware update.

Which router models are confirmed in the WPSplinter research?

Confirmed models include the ARRIS SURFboard AC1200, AT&T ARRIS BGW210-700, and Cisco RV110W, RV130W, RV215W, and RV340W routers. The researcher’s list is incomplete, so an unlisted model is not automatically unaffected.

Does changing my Wi-Fi password fix the Broadcom WPS flaw?

No, changing the Wi-Fi password does not address an attack that the researcher says works without the wireless password. Disable WPS and look for official firmware information for the exact router model.

Has Broadcom issued a CVE for WPSplinter?

No, Kaiser says Broadcom declined to assign a CVE or issue public communication about the flaws. Router owners should therefore rely on manufacturer support pages and provider notices for model-specific patch information.

Should I replace an old router affected by WPSplinter?

Yes, replacing an older router is the safer choice if the manufacturer no longer provides updates or if WPS cannot be disabled. Contact the router maker or internet provider before replacing provider-managed hardware, because the replacement may require account or service changes.