Decade‑old Broadcom WPS Flaw May Still Endanger Millions of Routers

A vulnerability in Broadcom's Wi‑Fi Protected Setup (WPS) code, traced to at least 2010, can let an attacker standing within Wi‑Fi range execute arbitrary code on a router without knowing the network password.

The bug lives in the portion of the WPS implementation that handles PIN exchanges. By sending specially crafted packets, an adversary can trigger a buffer‑overrun condition that bypasses normal authentication checks, granting low‑level access to the device.

Because Broadcom chipsets are embedded in a large share of consumer and small‑business routers, the flaw potentially affects millions of installations worldwide. Changing the Wi‑Fi password or using stronger WPA encryption does not mitigate the risk, as the exploit works before those layers are reached.

Broadcom told the reporting researcher that the vulnerable module was replaced in a 2018 software revision and that the affected code is now considered obsolete. The company declined to assign a CVE identifier, arguing that the version in question is no longer supported in current products.

Security analysts point out that many routers continue to run legacy firmware that never receives updates, meaning the patch may never reach devices already in the field. Without an official CVE, automated vulnerability scanners are less likely to flag the issue, reducing visibility for end users and administrators.

Experts recommend disabling WPS wherever the router interface allows it, applying any firmware updates that manufacturers have released, and replacing hardware that cannot be patched. Some industry observers suggest that regulators could require clearer disclosure of long‑standing vulnerabilities in widely deployed components.

The episode underscores a broader trend in IoT security: flaws discovered years ago can reappear when older code remains in circulation. Similar retroactive exposures, such as the 2017 KRACK weakness in WPA2, have shown how legacy implementations can become a vector for new attacks, prompting calls for more rigorous lifecycle management of embedded software.