Unpatched Broadcom Wi-Fi Flaw Allows Remote Code Execution on Routers

Broadcom Wi-Fi Flaw Disclosed

Security researcher Quentin Kaiser revealed a critical flaw in Broadcom's Wi-Fi setup software on October 16. This vulnerability allows an attacker within radio range to execute code as root on Broadcom-based routers. The attack does not require the network password or any prior pairing steps.

Technical Details of the Vulnerability

The flaw resides in Broadcom's implementation of Wi-Fi Protected Setup (WPS). Broadcom's code incorrectly handles the reassembly of fragmented WPS setup messages. This mishandling allows an attacker to send specially crafted messages that corrupt the router's memory, leading to remote code execution. Kaiser demonstrated the ability to read memory and run arbitrary code on affected devices.

Demonstrated Exploits and Impact

Kaiser successfully exploited the flaw against home gateways from three Belgian internet providers. In one instance, he read the Wi-Fi password (PSK) from an Orange Belgium gateway (Askey TCG3000) and used it to join the network. Against a Proximus gateway (Sagemcom BBOX3V+), he opened a reverse shell over Wi-Fi frames. These attacks were performed without any login credentials and work at a distance. No real-world attacks using this flaw have been reported, and the exploits are Kaiser's own work.

Affected Devices and Patch Status

Broadcom's WPS code is integrated into routers and access points from numerous vendors, with Kaiser estimating millions of affected devices worldwide. The vulnerable chips belong to two families: older eCos-based models (BCM3380, BCM3383, BCM33834), which Kaiser considers to have a permanent "forever day" flaw due to the unlikelihood of a fix, and newer Linux-based models (BCM3390, BCM65xx, BCM68xx), which could potentially be patched if manufacturers update their Wi-Fi software. No CVE has been assigned, and no fix has been deployed to the affected routers.