Broadcom WPS flaw leaves routers exposed to over-the-air takeover
Comments on “Broadcom WPS flaw leaves routers exposed to over-the-air takeover”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Researcher Quentin Kaiser presented "WPSplinter" at Hexacon, a memory flaw in Broadcom's legacy WPS Monitor that reassembles fragmented WPS messages without a size check. It is reachable over the air before pairing, so no password or PIN is needed. He demonstrated password theft on an Askey TCG3000 and a remote shell on a Sagemcom BBOX3V+. Broadcom says it replaced the code in 2018 but assigned no CVE. The claims come from a single source and are unverified. For device makers, old firmware may still carry it.
Why it ranked
No. 15 of 155 with a score of 0.68. The panel rated it highest on new information (0.95) and reader interest (0.79), lowest on audience breadth (0.53).
- AI judgeJudge 2claude-haiku-5-5
- Strong, specific, on-topic security news with technical detail on a pre-auth over-the-air router flaw; evidence comes from a researcher demo rather than a full published writeup, and the no-CVE status and distance claims leave some uncertainty.
- AI judgeJudge 3gpt-5.6-luna
- A technically specific, serious wireless router vulnerability enables unauthenticated over-the-air takeover, with demonstrated exploitation on real ISP gateways and clear remediation implications. Evidence is substantial but relies on researcher claims and lacks a CVE or public exploit.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.68total under rubric v2.2
- Significance0.69
- Reader interest0.79
- Audience breadth0.53
- Practical relevance0.70
- Substantiated0.63
- Technical depth0.71
- New information0.95
- Counts against: Promotional0.03
- Counts against: Overclaim0.19
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.63 | 0.62 | 0.83 | 0.69 | 0.21 | +0.24 | +0.167 |
| Reader interest | 0.60 | 0.84 | 0.94 | 0.79 | 0.34 | +0.26 | +0.206 |
| Audience breadth | 0.31 | 0.60 | 0.67 | 0.53 | 0.36 | +0.13 | +0.069 |
| Practical relevance | 0.52 | 0.70 | 0.88 | 0.70 | 0.36 | +0.22 | +0.154 |
| Substantiated | 0.46 | 0.72 | 0.72 | 0.63 | 0.26 | +0.05 | +0.032 |
| Technical depth | 0.75 | 0.68 | 0.70 | 0.71 | 0.07 | +0.05 | +0.035 |
| New information | 0.92 | 0.95 | 0.98 | 0.95 | 0.06 | +0.05 | +0.048 |
| Promotional | 0.04 | 0.03 | 0.01 | 0.03 | 0.03 | −0.19 | −0.005 |
| Overclaim | 0.23 | 0.25 | 0.08 | 0.19 | 0.17 | −0.11 | −0.021 |
| Sum of contributions | +0.684 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.684 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-28/15/"><img src="https://rubric.hrih.si/badge/2026-10-28/15.svg" alt="Ranked #15 on Rubric, 28 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 8 no source given. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenDate
A flaw in Broadcom's Wi-Fi software dating back to at least 2010 lets anyone within radio range take over a vulnerable router without its password.
The article gives no link or citation for it.
The article says “A flaw in Broadcom's Wi-Fi software dating back to at least 2010 lets anyone within radio range take over a vulnerable router without its password”
The source says No source to compare with.
No source givenNumber
Security researcher Quentin Kaiser presented the bug, named WPSplinter, at the Hexacon event, and it has no CVE assigned.
The article gives no link or citation for it.
The article says “Security researcher Quentin Kaiser presented the bug at the recent Hexacon event, naming it 'WPSplinter'; with no CVE assigned, it is the only label the flaw has”
The source says No source to compare with.
No source givenCausal conclusion
The bug lies in Broadcom's legacy WPS Monitor, which reassembles fragmented WPS messages without checking that the result fits in the memory allocated for it.
The article gives no link or citation for it.
The article says “When WPS messages arrive in fragments, the software stitches them back together without checking that the result fits in the memory set aside for it”
The source says No source to compare with.
No source givenCausal conclusion
An attacker can reach the vulnerable code over the air before pairing completes, so no PIN, button press or network key is required.
The article gives no link or citation for it.
The article says “An attacker can reach that code over the air before any pairing completes, so no PIN, no button press and no network key are required”
The source says No source to compare with.
No source givenNumber
On an Askey TCG3000 gateway supplied by Orange Belgium, Kaiser's code extracted the Wi-Fi password from the router's storage and sent it over the air.
The article gives no link or citation for it.
The article says “On an Askey TCG3000 gateway supplied by Orange Belgium, Kaiser's code pulled the Wi-Fi password from the router's storage and sent it over the air”
The source says No source to compare with.
No source givenNumber
On a Sagemcom-built Proximus BBOX3V+, Kaiser opened a remote shell running entirely over Wi-Fi frames.
The article gives no link or citation for it.
The article says “On a Sagemcom-built Proximus BBOX3V+, he opened a remote shell running entirely over Wi-Fi frames”
The source says No source to compare with.
No source givenQuote
Broadcom told the researcher it replaced the vulnerable code in 2018 but declined to assign a CVE, calling the software obsolete.
The article gives no link or citation for it.
The article says “Broadcom told the researcher it replaced the code from 2018, but declined to assign a CVE, calling the software obsolete”
The source says No source to compare with.
No source givenGeneralization
The weakness is in Broadcom's code, not in the WPS protocol itself, unlike the WPS PIN brute-forcing attacks of the early 2010s.
The article gives no link or citation for it.
The article says “Unlike the WPS PIN brute-forcing attacks of the early 2010s, the weakness is in Broadcom's code, not the protocol itself”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 2 pts, not on front page
Recorded for context only, checked 28 Oct 2026, 06:47 UTC. It played no part in the ranking.