Loading story…
Researcher Quentin Kaiser disclosed a memory-corruption vulnerability in Broadcom’s proprietary Wi-Fi Protected Setup (WPS) implementation that allows attackers within Wi-Fi range to execute code as root and disclose sensitive information without authentication. The flaw, present since at least 2010, affects WPS EAP message reassembly and requires neither a network password, completed WPS enrollment, nor user interaction. Kaiser demonstrated Wi-Fi password extraction from an Orange Belgium ASKEY TCG3000 gateway and a reverse shell carried over Wi-Fi frames on a Proximus Sagemcom F@st/BBOX3V+. He estimated that more than 1.5 million Belgian gateways could be exposed, with potentially millions of affected devices overall. Reporting as of October 19 identified no assigned CVE, deployed fix for the affected routers, or known real-world exploitation.
Broadcom reportedly issued an incomplete fix in 2018 and recommended migration to hostapd, but remediation depends on device architecture and manufacturer support. Older eCos-based gateways reportedly lack a usable fix, while newer Linux-based devices may be remediable through a Wi-Fi software change. Operators should inventory affected gateways, seek model-specific remediation guidance from vendors or ISPs, and plan replacement where supported fixes are unavailable; available detection tools offer only preliminary assessments. Volexity’s separate reporting on a Russian APT’s “Nearest Neighbor” attack underscores the operational relevance of nearby Wi-Fi networks, but the supplied reports establish no connection between that activity and this Broadcom vulnerability.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
On October 16, Kaiser disclosed the WPS flaw, which allows attackers within Wi-Fi range to execute code as root without authentication, a network password, or pairing. His research demonstrated Wi-Fi password extraction and subsequent network access on an Orange Belgium ASKEY TCG3000, plus a reverse shell transported over Wi-Fi frames on a Proximus Sagemcom BBOX3V+.
Kaiser reported the vulnerabilities to Broadcom in July 2026.
According to Kaiser, Broadcom released an incomplete fix in 2018 without publicly disclosing the vulnerability. Broadcom subsequently advised customers to migrate to hostapd rather than continue relying on its proprietary implementation.
Kaiser traced the vulnerable code in Broadcom’s proprietary wireless implementation to at least 2010. The flaw affects reassembly of fragmented WPS setup messages and enables memory disclosure and arbitrary code execution.
Kaiser's repository lists confirmed affected models from numerous manufacturers, including Cisco, Netgear, TP-Link, Nokia, ZTE and Zyxel, expanding the documented exposure beyond the original demonstrations. Version coverage varies, and some listed devices, including Huawei and Tenda models, lack clear confirmation.
Kaiser released YARA rules to identify vulnerable code in extracted firmware and a script to assess live access points. He cautioned that these tools provide preliminary triage rather than definitive confirmation because patched devices can still match.
CERT/CC closed Kaiser's case after confirming that Broadcom had authority to assign CVEs for its products but did not intend to assign one for this vulnerability.
Broadcom told Kaiser that a patch was available and directed affected manufacturers to contact it directly. According to Kaiser, the company declined to assign a CVE or share its customer-portal notification.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcesecurityaffairs.com
Open sourcequentinkaiser.be
Open sourcegithub.com
Open sourcevolexity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two major Wi‑Fi weaknesses that undermined protections widely assumed to be provided by WPA2. The **KRACK** attack, discovered by Mathy Vanhoef, abused the WPA2 four-way handshake to force key reinstallation, allowing a nearby attacker to replay, decrypt, or forge traffic and in some cases hijack TCP sessions or inject malicious content. Because the flaw targeted the protocol rather than a single product, it affected home, office, and public Wi‑Fi environments across many vendors and platforms, with **Android 6.0 and Linux** described as especially exposed due to implementations that could reset encryption keys to all zeros; Windows and iOS were considered harder to exploit. Security agencies and vendors, including CERT/CC, NCSC, Microsoft, and Google, issued warnings and began releasing patches. A later disclosure, **KrØØk** (`CVE-2019-15126`), showed that unpatched **Broadcom** and **Cypress** Wi‑Fi chipsets could encrypt some packets with an all-zero key after disassociation, letting nearby attackers decrypt portions of wireless traffic. ESET said the bug affected more than **one billion devices**, including smartphones, laptops, IoT products, routers, and access points from vendors such as Amazon, Apple, Google, Samsung, Asus, Huawei, Xiaomi, and Raspberry Pi. Although KrØØk was related to KRACK, it was a distinct flaw, and both incidents reinforced the same operational guidance: changing a Wi‑Fi password does not fix protocol or chipset weaknesses, while timely firmware and OS updates, plus relying on **HTTPS**, **VPNs**, or other end-to-end encryption for sensitive activity, materially reduce exposure.
Jun 29, 2026
Zyxel's **WAH7601** portable 4G router is affected by a set of four vulnerabilities, including the critical unauthenticated OS command injection flaw **`CVE-2026-13206`** and the high-severity credential exposure issue **`CVE-2026-12984`**. According to TR-CERT advisory **`TR-26-0799`**, all four flaws affect firmware through build **`20072026`**. The command injection bug is remotely exploitable and carries a **CVSS 9.8** score, while the credential issue, scored **CVSS 8.2**, can allow unauthorized retrieval of embedded sensitive data. The reported impact includes **root-level remote code execution**, credential theft, traffic interception, persistence on the device, and possible pivoting into internal networks after compromise. Public reporting said no active exploitation had been observed, but also noted that the vulnerabilities were **unpatched** at disclosure time. Recommended defenses include updating to the latest firmware if available, applying any vendor fixes, restricting or removing internet exposure of the management interface, strengthening access credentials, and replacing the device if access cannot be adequately controlled.
Aug 11, 2026
Two high-severity vulnerabilities have been disclosed in **BUFFALO Wi-Fi router products**, exposing affected devices to arbitrary code execution and OS command execution. `CVE-2026-32669` is classified as **CWE-94** and allows code injection that could let an attacker run arbitrary code on vulnerable routers, while `CVE-2026-33280` is a **CWE-912** hidden functionality flaw that could expose debugging features and enable arbitrary OS commands. Both issues carry high impact across **confidentiality, integrity, and availability**, with published scoring indicating network-based exploitation and low attack complexity for the command injection issue. The vulnerability records list **JPCERT/CC** as the receiving party, and references were added to **JVN** and a **BUFFALO advisory page**, signaling vendor and coordination activity around the affected router line.
Jun 29, 2026