Security researcher Quentin Kaiser presented the WPSplinter vulnerability in Broadcom Wi-Fi software at the Hexacon conference in Paris. The flaw allows attackers to gain root access to routers remotely without needing a Wi-Fi password or WPS pairing.
The vulnerability resides in the proprietary WPS Monitor component, which has been part of Broadcom's 802.11 software development kit since at least 2010. It stems from improper data length limitations during the reassembly of WPS messages, leading to buffer overflows and memory corruption.
The issue affects millions of wireless access points globally across various brands, including TP-Link, Cisco, Nokia, ZTE, Sagemcom, and Netgear. The exact list of vulnerable models remains incomplete due to variations in hardware and firmware versions.
The vulnerability currently lacks a CVE identifier. Broadcom stated that the software is no longer supported and claimed a fix was previously provided, though the researcher noted it was incomplete. As of October 15, tested devices had not received any patches.
