Broadcom WiFi bug undisclosed since 2010 enables remote RCE on millions of access points
dyn___ · x · 2026-10-22
Researcher Quentin Kaiser (Hexacon 2026) disclosed 'WPSplinter': a flaw in Broadcom's proprietary 802.11/WPS implementation present in their SDK since at least 2010. It is remotely exploitable over WiFi without knowing the network key, enabling controlled info disclosure and arbitrary code execution. It affects dozens of vendors and millions of Broadcom-based APs— a forever day on eCos platforms (BCM3380/3383/33834) and potentially on Linux platforms (BCM3390, BCM63xx/65xx/68xx). Broadcom has known since 2018, quietly shipped an incomplete patch, then replaced components with hostapd, but refused to assign a CVE. The researcher published docs, a fingerprinting script and YARA rules to map the blast radius; Telenet says it's unaffected.
More from Infra
- C multithreading experiment: padding counters to 64 bytes yields 3-4x speedup via false sharing fix — cneuralnetwork · 2026-10-23
- Two £300 Snapdragon mini PCs, no GPU: 46 tok/s local Qwen3.8 Flash Next with custom ToRc engine — WorldlyAd7946 · 2026-10-22
- ai& runs MiniMax H3 across NVIDIA, AMD and Tenstorrent, undercutting official pricing — DavidBennett__ · 2026-10-22
- With PS5 and Switch 2 jailbreaks taking off, could consoles run local LLMs? — cute_spider · 2026-10-22
- Jensen Huang defends neocloud financing: high borrowing costs are a side effect of huge AI demand, not a business flaw — rohanpaul_ai · 2026-10-22
- PHP, Node.js, GitLab and LiteLLM hit critical security incidents the same day — alex_verem · 2026-10-22