1.56 million Belgian routers may be vulnerable as Broadcom flaw turns sweet 16 and still lets strangers hijack routers

How the Wi-Fi flaw works

The vulnerability affects Broadcom’s handling of Wi-Fi Protected Setup, or WPS, which connects devices without requiring users to enter a network password. Kaiser found that specially crafted WPS messages could corrupt router memory and let an attacker within Wi-Fi range run code on the device.

The attacker would not need the Wi-Fi password, and the router owner would not have to take any action. In a demonstration on an ASKEY TCG3000 gateway, Kaiser extracted the Wi-Fi password from memory and transmitted it over the air, then used it to join the network.

Routers potentially affected

His rough estimates suggest about 850,000 Proximus gateways, 500,000 VOO devices and 210,000 Orange Belgium routers could be affected. Together, that would mean 1.56 million routers in Belgium, though Kaiser cautioned that the numbers are estimates.

Fixes remain uncertain

Kaiser says Broadcom knew about the vulnerability in 2018 and issued a partial fix without publicly disclosing it. The company later recommended that manufacturers replace its proprietary implementation with the open-source hostapd software.

AI sped up the research

Kaiser said AI helped accelerate his investigation. He estimated the work would normally have taken months, but said he completed it in less than a week with help from frontier models.