Nearby Attackers Can Gain Root on Broadcom Routers via Unpatched Wi-Fi Bug
Security researcher Quentin Kaiser disclosed on October 16 an unpatched flaw in Broadcom's Wi-Fi setup software. The issue allows an attacker within radio range to execute code as root on Broadcom-based routers without needing the network password or a pairing step. Kaiser demonstrated the attack against home gateways from three Belgian internet providers, and in one case read the Wi-Fi password from the device.
The disclosure centers on an unpatched flaw in Broadcom's Wi-Fi setup software, reported by security researcher Quentin Kaiser on October 16. An attacker close enough to be within radio range could run code as root on Broadcom-based routers, without the network password or a pairing step. Kaiser demonstrated this against home gateways from three Belgian internet providers, and in one instance read the Wi-Fi password from the device. The episode sits within broader concerns about router firmware security and the risks of flaws that remain unfixed.
Households and small organizations using Broadcom-based routers may face elevated risk if the flaw remains unpatched, since a nearby attacker could potentially take control of a gateway without credentials. That could expose Wi-Fi passwords, enable network eavesdropping, or let compromised devices join larger attacks. Internet providers and device makers may also face pressure to identify affected models and issue fixes. The practical impact depends on how many devices are vulnerable and how easily the attack can be repeated.