Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers

Summary: Researcher Quentin Kaiser disclosed on October 16 a flaw in Broadcom's Wi-Fi Protected Setup code that lets an attacker within radio range run code as root on Broadcom-based routers without the network password or any pairing step, and he demonstrated it against gateways from three Belgian providers. No CVE has been assigned and no fix has been deployed; Kaiser traces the code to at least 2010, says Broadcom shipped an incomplete fix in 2018 and then pointed customers to hostapd, and calls the older eCos-based chips (BCM3380, BCM3383, BCM33834) a permanent "forever day" with no usable fix.
What you should know: Kaiser estimates millions of devices worldwide are affected and says Broadcom has known about the bug since 2018 but would not register a CVE or speak publicly, which he believes is why many device makers never patched - and CERT/CC closed his case the same day because Broadcom holds CVE authority for its products. With no patch and no setting that blocks the over-the-air attack, the only practical option for gear that will never be fixed is replacement.

Read the original at The Hacker News ↗