A researcher has disclosed an unpatched flaw in Broadcom's Wi-Fi Protected Setup implementation that lets an attacker within radio range run code as root on Broadcom-based routers without the Wi-Fi password or any pairing step. Quentin Kaiser, who published on 16 October, exploited Broadcom's mishandling of fragmented WPS setup-message reassembly to corrupt router memory, then built primitives to read memory back off the device and to execute his own code. Against an Askey TCG3000 gateway supplied by Orange Belgium he read the stored Wi-Fi PSK off the device over the air and joined the network with it; against a Proximus Sagemcom BBOX3V+ he opened a reverse shell carried inside Wi-Fi frames, needing no outside server. No CVE has been assigned and no fix has been deployed. Older eCos chips (BCM3380, BCM3383, BCM33834) have no usable fix and Kaiser calls them a permanent "forever day"; newer Linux-based chips (BCM3390, BCM65xx, BCM68xx) could be fixed by switching Wi-Fi software. He estimates millions of devices across dozens of vendors are affected and reports no real-world exploitation.

• Source article