WPSplinter: The Router Flaw Nobody Plans to Fix

Someone parks a car on your street, opens a laptop, and never touches your front door. They don't know your Wi-Fi password. They don't need to. Within minutes they are running their own code on the router your internet provider mailed you years ago, and they can read the password straight out of its memory.

That is not a movie plot. It is what security researcher Quentin Kaiser demonstrated on a real home gateway with a flaw he calls WPSplinter, a router flaw in Broadcom's Wi-Fi code that dates back to at least 2010. No patch exists for the affected devices he tested, Broadcom declined to give it a CVE number, and for one family of chips there may never be a fix at all.

Below you will learn how the WPSplinter router flaw works, why a 16-year-old bug survived this long, how to tell whether your router is likely exposed, and what to do this week if it is.

How the WPSplinter Router Flaw Works

WPS is the feature behind the little button on many routers. You press it, and a printer or TV joins your network without typing a password. To make that work, the router listens for special setup messages over the air, all the time, from anyone in range.

Broadcom's code for reassembling those messages has a memory bug. Setup messages arrive in fragments, and the router stitches them back together. Send fragments crafted the wrong way, and the router corrupts its own memory in a way an attacker can steer. The result is code running as root, which is the highest level of control a device has.

Kaiser presented the research at the Hexacon security conference in Paris on October 16. According to The Hacker News, he showed two working attacks:

• An Askey TCG3000 gateway from Orange Belgium: the exploit pulled the Wi-Fi password from the router's stored settings, sent it back over the air, and joined the network with it.
• A Sagemcom-built BBOX3V+ from Proximus: the exploit opened a remote command shell carried entirely inside Wi-Fi frames, with no outside server needed.

Two details make this worse than a typical router bug. First, no login and no pairing step is required. Second, the attack travels over radio, so it skips your firewall entirely. A firewall guards the cable coming in from the internet. It does nothing about a stranger talking to the antenna.

Why a 16-Year-Old Bug Was Never Fixed

The history should bother you more than the bug itself. The flaw was not hiding.

Broadcom told Kaiser it had known about the problem since 2018. It shipped a partial fix that year without public disclosure and advised device makers to move to hostapd, the open-source Wi-Fi software most Linux systems use. Kaiser says that 2018 fix was incomplete.

Here is the timeline from his disclosure, as reported by The Register:

1. July 18 and July 27: Kaiser reports the bug to Broadcom.
2. July 28: Broadcom says a patch exists and tells him to contact the device makers directly.
3. July 29: Broadcom declines to assign a CVE and won't share the notice it says it sent manufacturers.
4. August 4: CERT/CC, the coordination center that usually steps in, closes the case. Broadcom is its own CVE Numbering Authority, so CERT/CC could not assign one over its objection.
5. October 15: none of the affected devices Kaiser identified had received a patch.

Why does a missing CVE matter so much? Because the CVE number is how the security world tracks a problem. ISPs, router makers, and scanning tools watch CVE feeds. A bug without one never shows up on the dashboards that trigger firmware updates. Kaiser believes that is exactly why so many manufacturers never acted.

The "forever day" chips

Kaiser splits affected hardware into two groups. Linux-based chips (BCM3390, BCM65xx, BCM68xx) can be fixed if the manufacturer switches its Wi-Fi software. The older eCos-based chips (BCM3380, BCM3383, BCM33834) are different. He found no usable fix and calls them a "forever day," meaning a vulnerability that will never be patched for the life of the device.

Is Your Router Affected? How to Check

There is no public master list of every vulnerable model. Kaiser published detection rules and a script on GitHub (under qkaiser/broadcom-wps), but they are built for security researchers, not for someone at a kitchen table. You can still narrow it down in about 15 minutes.

1. Find out who owns the box. Check your bill for an equipment or gateway line. If your ISP supplied a combined modem and router, the ISP controls its firmware, not you.
2. Read the label. The sticker on the bottom gives the brand, model number, and usually an FCC ID. Write all three down.
3. Look up the chipset. Search the model number plus "chipset" or look up the FCC ID filing. Cable gateways from the early and mid 2010s often use the BCM338x family named above.
4. Check the age. If the manufacture date on the label is before 2018, the device predates even Broadcom's partial fix.
5. Ask your provider directly. Call or chat and ask whether your gateway model is affected by WPSplinter. Give them the model and year.

Confirmed affected devices so far are ISP gateways from Proximus, Orange Belgium, and VOO in Belgium. Kaiser's wider list also flags Cisco small-business access points and some Huawei and ARRIS routers, though it mixes confirmed and "likely vulnerable" entries. Broadcom Wi-Fi sits inside routers from dozens of brands, so a model missing from the list proves nothing.

If you run your own network gear at home, it is also a good moment to harden the accounts behind it. Moving your router admin login and email to passkeys instead of passwords means a stolen Wi-Fi key does not open everything else.

What to Do This Week If You're Exposed

The reality is that settings changes are a stopgap here. Kaiser's documentation warns that the WPS toggle in your router's menu may not switch off the vulnerable parser, because the code that reads incoming messages can run before the setting is checked. Treat the steps below as ranked, strongest first.

1. Replace or swap the device

For an eCos-based gateway, replacement is the only real fix. If the ISP owns it, ask for a newer model. Providers routinely swap aging gateways, and a known unpatched flaw gives you a clear reason to ask.

2. Turn the gateway's Wi-Fi radio off completely

The attack arrives over Wi-Fi. A radio that is fully disabled cannot receive the malicious setup messages. Many ISP gateways offer a bridge mode or a setting to disable wireless entirely. Then plug in your own modern router to handle Wi-Fi. This is not a guarantee, since some firmware may not truly power the radio down, but it removes the attack path the demos used.

3. Disable WPS anyway and change the Wi-Fi password

Disabling WPS shuts down older, unrelated WPS attacks even if it does not stop this one. If you suspect someone has already grabbed your password, change it, and change the router's admin password too.

4. Isolate the devices you can't update

Smart plugs, cameras, and TVs rarely get security updates. Put them on a separate guest network. If your router is ever compromised, the attacker still has to work harder to reach your laptop. Our look at what your smart TV collects shows why those devices deserve their own lane anyway.

The Cost of Swapping Out an Old Router

Replacing hardware sounds expensive. Run the numbers on your own bill before deciding.

Say your bill shows a $14 monthly equipment charge for a gateway that is eight years old. That is $168 a year, and $1,344 over the eight years you have already paid. Now price the alternative:

• Option A, ask the ISP for a newer gateway: usually $0 upfront, same $14 a month. Fixes the flaw if the new model uses a different chipset.
• Option B, buy your own: roughly $100 for a compatible cable modem and $120 for a Wi-Fi 6 router, so $220 once.

At $14 a month, Option B pays for itself in about 16 months ($220 divided by $14 is 15.7). After that it saves $168 every year, and you control the firmware updates. Check that the modem is on your ISP's approved list first, because an unsupported modem simply won't connect.

If your plan carries no equipment fee, the math flips. Ask for a swap and keep the money. Either way, the device that has been quietly sitting behind your TV for a decade is now the weakest thing in your home.

Frequently Asked Questions

What is the WPSplinter vulnerability?

WPSplinter is a memory bug in Broadcom's Wi-Fi Protected Setup code, disclosed by researcher Quentin Kaiser in October. An attacker within Wi-Fi range can send crafted setup messages and run code as root on the router without knowing the Wi-Fi password.

Does turning off WPS protect my router?

Not reliably. Kaiser warns the vulnerable parser may still process incoming messages even when the WPS setting is off. Disabling WPS is still sensible, but replacing the device or disabling its Wi-Fi radio entirely is the stronger move.

How do I know if my router has a Broadcom chip?

Find the model number and FCC ID on the router's label and search for its chipset. Cable gateways from the 2010s often use Broadcom BCM338x chips. Your ISP can also confirm the chipset if it supplied the device.

Has WPSplinter been used in real attacks?

Kaiser has reported no evidence of attacks in the wild, and the working exploits are his own. That could change quickly now that the details are public, which is why replacing exposed devices matters sooner rather than later.

Your Router Deserves a Birthday Check

Most people replace a phone every three years and a router never. WPSplinter shows the cost of that habit: a bug from 2010, known to the chipmaker since 2018, still sitting in homes because nobody gave it a tracking number.

Spend 15 minutes this week reading the label, calling your provider, and pricing a swap. If the box is older than your current phone's battery, it has probably earned retirement. The next researcher to find a flaw like this may not be the one who tells the public first.