A security vulnerability in Broadcom’s Wi-Fi Protected Setup (WPS) code could leave millions of home routers exposed to attacks, with security researcher Quentin Kaiser warning that an earlier fix never reached many devices deployed by internet service providers (ISPs).
The flaw, dubbed WPSplinter, was presented by Kaiser at the Hexacon security conference in Paris on October 16, 2026. According to his findings, the vulnerability affects legacy Broadcom code used in routers and internet gateways from multiple manufacturers. An attacker within range could extract sensitive information from a device’s memory or execute code remotely without knowing the Wi-Fi password.
The issue has drawn attention not only for its technical severity but also because Broadcom reportedly acknowledged discovering the problem in 2018. Kaiser argues that the absence of a formal Common Vulnerabilities and Exposures (CVE) identifier helped prevent the fix from reaching affected devices through established security update channels.
What Is the WPSplinter Vulnerability?
WPSplinter affects an older implementation of Wi-Fi Protected Setup, a feature designed to make it easier to connect devices to wireless networks. WPS traditionally allows users to connect compatible devices by pressing a button on their router, rather than manually entering the network password.
The vulnerability lies in how Broadcom’s legacy software processes certain WPS messages. According to Kaiser’s research, carefully crafted sequences of messages can exploit weaknesses in the code, potentially allowing an attacker to read the router’s memory or execute code on the device.
The attack does not require the Wi-Fi password or a successful WPS pairing. An attacker needs to be within wireless range of the vulnerable equipment, making the issue particularly concerning for routers installed in homes and small businesses.
WPSplinter is also distinct from the PIN-based WPS vulnerability that attracted widespread attention in the early 2010s. Rather than exploiting the design weakness associated with the WPS PIN authentication method, this attack targets flaws in Broadcom’s implementation of the protocol.
Researchers Demonstrate Attacks on ISP Routers
Kaiser’s demonstrations illustrate how the vulnerability could affect real-world equipment supplied by internet service providers.
On an Askey TCG3000 gateway distributed by Orange Belgium, the researcher demonstrated an exploit that extracted the Wi-Fi key from the device’s non-volatile random-access memory (NVRAM). The key was then transmitted wirelessly, allowing him to use it to connect to the network.
In a separate demonstration involving the Proximus BBOX3V+, manufactured by Sagemcom, Kaiser reportedly obtained a remote shell over Wi-Fi. The attack did not require an internet connection on the attacker’s side.
Kaiser also stated that the vulnerability could be exploited over relatively long distances, although the practical range would depend on the equipment and wireless conditions involved.
These demonstrations suggest that the consequences extend beyond unauthorised access to a wireless network. Depending on the affected device and the exploit used, an attacker could potentially gain deeper access to the router itself.
Around 1.5 Million Belgian Routers Could Be Affected
Kaiser confirmed the vulnerability on gateway devices associated with three of Belgium’s four major internet providers: Proximus, Orange and VOO.
Based on his assessment, approximately 1.5 million devices in Belgium could be vulnerable. The potential exposure is not limited to the Belgian market, however, because Broadcom-based networking equipment is sold and deployed internationally.
Kaiser’s published list of potentially affected hardware includes devices from Cisco, TP-Link, Netgear, Sagemcom, Nokia, ZTE and Zyxel. Similar equipment has been deployed by internet providers in several countries, including Movistar, Optus, KPN and Türk Telekom.
The researcher cautions that the list is incomplete. Based on the international use of affected chipsets and software, he estimates that the number of vulnerable devices worldwide could reach the low hundreds of millions.
That global figure remains an estimate rather than a confirmed count. The actual number of exposed routers will depend on their hardware configurations, firmware versions, software modifications and whether vendors have applied effective fixes.
Why an Earlier Fix May Have Failed to Reach Users
The vulnerability’s history raises questions about how security fixes move through the networking supply chain.
According to Kaiser, he reported the issue to Broadcom in July 2026. The company responded that it had known about the problem since 2018 and had subsequently replaced the older WPS implementation in its software. Broadcom directed the researcher to the manufacturers responsible for the finished devices.
Kaiser maintains that the earlier correction was incomplete and did not fully address the underlying issue. He also says Broadcom declined to request a CVE identifier, arguing that the affected code was obsolete and outside its support period.
A CVE identifier provides a standard reference for a publicly recognised cybersecurity vulnerability. Vendors, security researchers and IT administrators use these identifiers to track flaws, publish advisories and coordinate patches.
Without one, a vulnerability can be harder to identify and follow across different manufacturers and products. Router makers and ISPs may not receive the information in a format that triggers their usual security assessment and update processes.
The dispute has prompted debate over responsibility. Some commentators argue that device manufacturers and internet providers should have ensured their firmware remained secure. Kaiser’s position is that the lack of formal vulnerability tracking may have prevented critical information from reaching those organisations in the first place.
The case highlights a broader challenge in hardware security: a chipmaker may correct a flaw in its own software, but the correction offers little protection if manufacturers continue shipping devices with vulnerable code.
AI Helped Identify the Flaw in Less Than a Week
Another notable aspect of the investigation is the role of artificial intelligence in security research.
Kaiser said AI tools helped him discover the vulnerability in less than a week, a task he believes could have taken months using traditional manual analysis alone.
Router firmware can be difficult to examine because it often contains large amounts of compiled code, proprietary components and software inherited from older platforms. Historically, the time and expertise required to analyse these systems provided a practical barrier to discovering certain vulnerabilities.
AI-assisted analysis is beginning to reduce that barrier by helping researchers examine code, identify suspicious patterns and narrow down potential weaknesses more quickly.
The same development also creates risks. Techniques that accelerate vulnerability discovery for legitimate researchers could also help malicious actors identify weaknesses in widely deployed devices. Older firmware that has received little security attention may be particularly exposed to this change.
How Router Owners Can Reduce Their Risk
Changing a Wi-Fi password will not resolve WPSplinter, as the reported attack occurs before normal network authentication. Disabling WPS is a sensible precaution, but Kaiser warns that turning off the feature through a router’s settings may not completely disable the vulnerable code.
Users should check whether their router manufacturer or internet provider has issued a firmware update addressing the problem. Because the affected hardware and software configurations vary, the presence of a Broadcom chipset alone does not establish that a particular router is vulnerable.
For users who cannot obtain a clear answer about their ISP-supplied gateway, Kaiser recommends disabling its Wi-Fi, switching the device to bridge mode where supported, and using a separate, up-to-date router for wireless connectivity. This approach can reduce exposure through the gateway’s wireless interface, but it should not be treated as a universal fix for every possible attack path.
Kaiser has also published a detection script on GitHub to help users and administrators check their equipment. Anyone using such a tool should follow its documentation and confirm that it supports their device before running it.
A Wider Warning for Router Security
WPSplinter exposes a weakness in the way long-lived networking equipment is maintained. Routers often remain in service for years, and users may depend on internet providers to manage firmware updates without knowing which chipsets or software components their devices contain.
The reported gap between Broadcom’s earlier fix and the continued presence of vulnerable code in deployed gateways highlights the difficulty of coordinating security updates across chipmakers, hardware manufacturers and ISPs.
The absence of a CVE identifier has also renewed questions about how vulnerabilities in legacy components should be disclosed and tracked, particularly when those components remain embedded in products used by millions of people.
Until affected manufacturers and providers establish which devices are vulnerable and deliver effective updates, WPSplinter remains a concern for router security. The findings also serve as a reminder that fixing a software flaw is only one part of the process. Ensuring that the correction reaches the devices already in people’s homes is just as important.
 code could leave millions of home routers exposed to attacks,){kind=link}