This Broadcom Wi-Fi Bug Is Old Enough To Drive. It Still Hands Hackers Your Password

A car is parked outside your home. Nobody gets out. But minutes later, the person inside has your Wi-Fi password and control of your router. They never knocked on your door or guessed a password, and you certainly didn't click on any malicious links. All because of a 16-year-old bug in Broadcom's Wi-Fi software.

A researcher has demonstrated how a Wi-Fi bug can expose your router's password to an attacker within Wi-Fi range using a few clever pieces of code.^[1] Once an attacker gains control of your router, they may be able to monitor or manipulate network traffic, redirect you to fake banking, email, or social media pages, and potentially expose you to financial fraud and identity theft.

Here's everything you should know about this Wi-Fi bug, along with the steps you can take to keep your Wi-Fi traffic secure.

Thanks for subscribing!

Please check your email for your first message.

Never miss the privacy news that affects you.

Join thousands who get the latest security news, scams, and policy changes every week, right to their inbox.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

What is WPSplinter and how does it work

Many home internet routers contain a chip made by Broadcom, which comes with the company's own software development kit (SDK). Security researcher Quentin Kaiser has found a flaw in this software that has existed since at least 2010. Anyone within Wi-Fi range could exploit it to send malicious wireless messages to your router and take control of it without knowing your password.

The bug has been named WPSplinter, after the routers' built-in Wi-Fi Protected Setup (WPS) feature. This lets you connect another device to your network without typing in the password, usually by pressing a small button on your router. To make this work, the router has to listen for and process messages from devices that aren't yet connected to the network. This is exactly where the weakness lies.

Some of these setup messages are split into chunks, which the router then puts back together. This process is known as reassembly. By sending carefully crafted pieces of setup messages, an attacker can exploit the flaw to access information from the router's memory that shouldn't be exposed (information disclosure) and potentially make the router run the attacker's own code (arbitrary code execution).

Kaiser demonstrated exploits against two routers:

• On an Orange Belgium router, his code pulled the Wi-Fi password out of the router's internal storage and sent it back to him over the air. He could then use it to join the network like any other user.
• On a Proximus router, he was able to open a reverse shell, which provides remote access to the router's command line. Usually, attackers need a command-and-control server to facilitate this kind of remote access. Here, Kaiser did it entirely through Wi-Fi signals.

Which routers are affected by WPSplinter

Kaiser estimates that at least 1.5 million routers in Belgium could be affected. However, this is only an estimate based on ISP data and information about router models released over the years. The figure includes around 850,000 affected routers from Proximus, 500,000 from VOO's legacy fleet, and 210,000 from Orange Belgium.

Kaiser has confirmed that Telenet is not affected, after its engineers checked the entire fleet for signs of the vulnerable wps_monitor process and found none.

Proximus has now disabled WPS across its fleet of BBoxes. The company is expected to carry out full patching in the coming weeks. Orange Belgium, on the other hand, is looking into the matter and analyzing the possibility of disabling WPS across its affected infrastructure.

Broadcom's handling of the flaw has left older routers vulnerable

According to Kaiser's blog, Broadcom has known about the flaw since at least 2018. That year, the company released a fix that didn't fully solve the problem, without making a public announcement. It later released a new version of its software that replaced the vulnerable components with an open-source implementation called hostapd, and recommended that manufacturers migrate to it rather than fully fixing the old code.

Older routers running eCos had no path to that new version, leaving them effectively unfixable. For Linux-based platforms, fixing the problem depends on whether individual manufacturers are willing to migrate to the newer software.

When Kaiser reported the bugs to Broadcom in July 2026, the company replied that a patch was available and told him to ask the affected device manufacturers to contact Broadcom. The company also refused to assign a CVE, a standard public identifier used to track and communicate information about security vulnerabilities.

On August 4, Kaiser went to CERT/CC, a US body that helps coordinate vulnerability disclosures. However, it closed the case the same day because Broadcom was authorized to assign its own CVEs and had made it clear that it wouldn't do so.

Since Broadcom didn't publicly disclose the flaw or issue a CVE, manufacturers may not have realized that they needed to patch it. This could help explain why the vulnerability has survived for over 16 years.

The risks of a compromised router

Your router is the gateway to your network activity, and an unauthorized person controlling it could put your entire home network at risk. Besides stealing your Wi-Fi password, as Kaiser demonstrated, an attacker could potentially intercept or collect network traffic, including information about the websites and services you access.

This could also allow an attacker to steer you toward phishing pages or look-alike domains, such as fake banking, email, or shopping websites. These bogus sites imitate their legitimate counterparts and might trick you into giving away your credit card details, email address, and phone number.

Once such personally identifiable information has been compromised, attackers could use it for financial fraud and identity theft. Attackers may also be able to access other devices connected to your router, such as shared folders, laptops, printers, security cameras, and other smart home gadgets, particularly if those devices are poorly protected.

What can you do to protect your Wi-Fi network

One thing to understand is that this flaw cannot be exploited by just anyone on the internet. An attacker must be within Wi-Fi range of your router, although Kaiser notes that the attack can work over longer distances. Even so, this reduces the opportunities for an attack.

Here are a few steps you can take to improve your security.

1. Check all connected devices: Log in to your ISP router's settings page, where you can check the connected devices. Look for any unfamiliar devices and investigate them before disconnecting them.
2. Change your Wi-Fi password: If you suspect that an unauthorized person has accessed your network, change your Wi-Fi password. This will prevent someone from using the old password to reconnect, although it won't remove the underlying router vulnerability.
3. Turn off the WPS setting: The flaw affects the router's WPS EAP reassembly code. Disabling WPS can help mitigate the risk, and Proximus has already disabled it across its BBox fleet. You can usually do this by logging in to your router's settings page or contacting your ISP.
4. Protect your traffic: Stick to websites that use HTTPS, and keep your devices and software updated. Consider using a reputable VPN, which encrypts your internet traffic between your device and the VPN server. This can help prevent someone controlling your router from reading the contents of that traffic, although they may still be able to see that you're connecting to a VPN service.

If you suspect that your router has already been compromised or that you have exposed your personal details, consider using an identity theft protection service. These tools can scan known breached databases for your personally identifiable information and alert you if it appears. This can help you identify exposed information and take appropriate steps to protect your accounts before attackers can misuse it.

The bottom line

WPSplinter has survived for 16 years, and Kaiser’s findings indicate that affected routers still lack a complete patch. He estimates that around 1.5 million routers in Belgium could be affected. However, several other router manufacturers also use Broadcom's SDKs, which means the actual number of affected devices could be much higher.

Broadcom hasn’t publicly disclosed the vulnerability or assigned it a CVE, while the availability of a permanent fix depends on the affected platform and manufacturer. You can take preventive measures to reduce your risk, including disabling your router's WPS setting, checking connected devices, and changing your Wi-Fi password if you suspect unauthorized access.

However, these steps are not a substitute for a proper security update. Contact your internet service provider to ask whether your router is affected and whether a firmware fix or other mitigation is available.

All-in-One Digital Security App with Servers in All 50 U.S. States

5.0

AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.

Editorial Rating

Claim Deal

On NordVPN's website

2026 Editors’ Choice

Best Features

VPN

NordVPN

PROMOTION: Save Up to 75% Off and Get 3 Months Extra

• VPN that earned the only Platinum rating in a five-way independent speed and security test by Artifact Security
• Historically unlocks Netflix libraries in the US, Canada, UK, and Australia with no errors
• Bundles with ad blocker, data removal, and encrypted storage for a more complete privacy setup

Author Details

Krishi Chowdhary

About the Author

Krishi Chowdhary specializes in digital privacy, cybersecurity, and consumer technology. He has written extensively on online privacy tools and broader cybersecurity topics, including online scams, data breaches, age verification, and emerging digital threats. Krishi believes technology reporting should empower readers, not confuse them, and is committed to making even the most technical subjects easy to understand without compromising on accuracy or depth. His work has appeared in leading technology publications, including CNET, ExpressVPN, and TechRadar, where he has covered topics ranging from cybersecurity incidents and privacy product announcements to artificial intelligence and major technology news