A security vulnerability dubbed WPSplinter affects millions of home routers and internet gateways using Broadcom software. Discovered by researcher Quentin Kaiser, the flaw allows attackers within Wi-Fi range to read device memory or execute arbitrary code without needing network passwords or completing the WPS handshake process.
Kaiser demonstrated the exploit on Askey TCG3000 and Sagemcom Proximus BBOX3V+ gateways in Belgium. The attack enables unauthorized access to Wi-Fi keys and remote command shells. The researcher noted that the vulnerability is distinct from previous WPS PIN flaws and remains effective even at significant distances.
Broadcom reportedly knew about the issue since 2018 but claimed the code was patched and outdated, declining to assign a CVE identifier. Kaiser argues the fix was incomplete, leaving devices from manufacturers like Cisco, TP-Link, Netgear, Nokia, ZTE, and Zyxel potentially exposed. The researcher used AI tools to identify the flaw in under a week.
Changing Wi-Fi passwords does not mitigate the risk, as the attack occurs before network authentication. While disabling WPS may help, Kaiser recommends using the gateway in bridge mode with a separate, updated router. A detection script for the vulnerability has been published on GitHub.
