Millions of Wi-Fi Routers at Risk From 16-Year-Old Flaw That Requires No Password

A security researcher has uncovered a serious vulnerability in Broadcom software that allows some Wi-Fi routers to be taken over without knowing the password. The issue has existed since 2010 and could affect millions of devices worldwide.

Security researcher Quentin Kaiser presented a vulnerability dubbed WPSplinter at the Hexacon 2026 conference in Paris. It is found in an older implementation of Broadcom’s Wi-Fi Protected Setup (WPS) technology, whose chips and software are used in routers from many manufacturers.

The main issue is that an attacker does not need to know the wireless network password or be connected to the network. They only need to be within Wi-Fi range of a vulnerable router. By sending specially crafted data, they can exploit a flaw in how communications are processed and potentially gain control of the device.

According to Kaiser, the vulnerability has been present in Broadcom’s software package since at least 2010. The researcher estimates that it could affect hundreds of router models from dozens of manufacturers, with the total number of vulnerable devices potentially reaching millions.

An attacker could obtain the password and take full control of the router

The vulnerability is related to how Broadcom WPS Monitor software processes and reassembles fragmented EAP-WPS protocol messages. Insufficient checks on their size can cause a buffer overflow, allowing an attacker to read memory contents or execute their own code.

Kaiser demonstrated the attack on devices provided by Belgian internet operators.

On an Askey TCG3000 router from Orange Belgium, he was able to remotely execute his own code, retrieve the stored Wi-Fi password, and then use it to connect to the network.

On a Sagemcom BBOX3V+ device from operator Proximus, he created remote access to the router’s command line. The communication took place directly over Wi-Fi frames, so it did not require an external internet server.

On vulnerable devices, the attack could lead to the highest system privileges. An attacker could then manipulate the router’s configuration or network traffic, or use the device to carry out further attacks.

Routers from several well-known brands could be at risk

The vulnerable software appears in devices from various manufacturers, including TP-Link, Netgear, Cisco, Nokia, Huawei, ZTE, Zyxel, Sagemcom, and Askey.

Models included in the researcher’s list include:

• TP-Link Archer C3150, Archer C5400, VR600, VR900, and VR2800
• Netgear CG3100 and CG3700B
• Cisco RV110W, RV130W, and RV215W
• Huawei B310, B315, and B593
• ZTE F680 v4
• Zyxel VMG3312-B10A and B10B

However, the list is not complete, and the vulnerability has not been confirmed to the same extent for every device. The specific hardware and firmware versions are what matter—not the brand itself or simply whether the device contains a Broadcom chip.

The researcher has also released tools for identifying potentially vulnerable devices.

The flaw was known about for years, but fixes did not reach everyone

Notably, according to the researcher, Broadcom had known about the issue since at least 2018, when it released an incomplete fix. It subsequently began recommending that manufacturers switch to a different software implementation known as hostapd.

However, not all manufacturers made the change, and many older routers remained on the original software. The issue is particularly difficult to address on devices running the eCos operating system, for which there may no longer be a viable path to a fix.

Broadcom declined to assign the vulnerability an official CVE identifier, citing the fact that the affected software is no longer supported.

Kaiser says that, as of October 15, 2026, the vulnerable devices he identified at Belgian operators had not received a fix. There are no confirmed reports of the flaw being actively exploited in real-world attacks so far.

How can users protect themselves?

The most important step is to check whether a router firmware update is available and ask the manufacturer or internet service provider whether the specific model uses vulnerable software.

Simply disabling WPS in the settings may not be enough, as some devices may continue to use the vulnerable software component. Changing the Wi-Fi password alone will not help either, since the attack does not exploit a weakness in the password.

For older routers that no longer receive security updates, replacing them may be the only reliable solution.

WPSplinter highlights a broader problem with network device security. Routers often remain in homes and businesses for many years, while their software may not receive regular fixes. As a result, vulnerabilities can persist across entire generations of hardware.

You can find the list of affected devices here.

Comments

Name:

:)