Broadcom Wi-Fi bug turns sweet 16, still lets strangers hijack your router
A long-standing flaw in Broadcom Wi-Fi software could let someone within wireless range take control of vulnerable routers without knowing the network password. Researcher Quentin Kaiser says the issue dates back to at least 2010, and claims Broadcom knew about it in 2018 but issued only a partial fix; the disclosure raises questions about how many devices remain exposed and whether their makers will update them.
Kaiser demonstrated the attack on routers supplied by Belgian providers Proximus, Orange and VOO, as well as devices from Netgear and Technicolor. He estimates about 1.56 million routers in Belgium may be affected, though the figure is rough, and says the global total could be much higher because Broadcom technology is widely used. Older routers may never receive a fix, and Kaiser said none of the affected devices he had identified was patched by 15 October; he reported no evidence of attacks in the wild.
- Broadcom Wi-Fi flaws could let nearby attackers take over routers.
- An estimated 1.56 million Belgian routers may be affected.
- Some older devices may never receive a fix.
New here? Start with this
Broadcom makes wireless chips and software used in routers, the devices that connect homes and businesses to the internet. Router makers and internet providers build products around this technology, so a weakness in Broadcom software can affect equipment from several different brands.
Quentin Kaiser is a security researcher who says the flaw has been present since at least 2010 and that Broadcom knew about it in 2018. He demonstrated it on routers supplied by Belgian internet providers and on devices from Netgear and Technicolor; the reported weakness could let someone nearby take control without the Wi-Fi password.
The issue matters because routers carry internet traffic for everyone connected to them, and older models may no longer receive software updates. Estimates of how many devices are affected are uncertain, and Kaiser reported no evidence that attackers had used the flaw.