Broadcom says it fixed a 16-year-old Wi-Fi flaw years ago, but the fix never reached many affected routers. Millions of devices may still be vulnerable, and some older hardware can’t run the replacement software.
Known to security researchers as WPSplinter, the vulnerability lets an attacker within radio range take control of certain routers without knowing the Wi-Fi password. Security researcher Quentin Kaiser presented the findings at the Hexacon conference. According to Kaiser, the attack can work from a relatively long distance: in some tests, he gained administrator privileges from across the street.
The patching history is central to the problem. Kaiser reported the vulnerability to Broadcom in July 2026 and was told the company had known about it since 2018. Broadcom said it had since replaced its old WPS Monitor component with a more modern, open-source alternative.
Kaiser disputes whether the earlier fix was complete, saying the 2018 patch did not fully resolve the vulnerability. Broadcom’s newer software package no longer contains the vulnerable component, but that only protects devices whose manufacturers have adopted the newer version and delivered the required firmware.
As TechRadar reports, Broadcom did not issue a public security advisory or request a CVE identifier, citing the software’s age and the fact that it was no longer supported. Researchers use the name WPSplinter because the flaw has no CVE identifier. Vendors and operators tracking remediation are therefore left without a standard vulnerability identifier or a public Broadcom advisory to follow.
The bug sits in Broadcom’s older WPS Monitor component, which handles Wi-Fi Protected Setup, or WPS. This is the feature on many home routers that lets you pair devices with a button press.
When WPS Monitor reassembles incoming fragmented messages, it doesn’t properly check whether the resulting data fits in the memory allocated for it. That can cause a buffer overflow, which an attacker within radio range can exploit to read the router’s memory and execute code on the device.
Unlike the brute-force attacks against WPS PINs that became common in the early 2010s, WPSplinter is a flaw in Broadcom’s implementation, not in the WPS protocol itself. The attack happens before authentication, so changing the Wi-Fi password doesn’t protect against it. Switching off WPS isn’t sufficient either.
Whether a router can be fixed depends partly on its hardware. Older eCos-based BCM3380, BCM3383 and BCM33834 chips cannot migrate to the newer software. In Kaiser’s assessment, devices using those chips will effectively remain vulnerable forever, leaving them exposed to attackers.
Linux-based BCM3390, BCM63xx, BCM65xx and BCM68xx chips can be patched, provided the router manufacturer creates and releases the required firmware update. Removing the component from Broadcom’s own software package is only one step: the replacement still has to reach the router.
For owners, the options are limited. Keep firmware up to date and check whether the router manufacturer or internet service provider has released a security update for your model. If the router can no longer be updated, replacing it is the more drastic option.
