Broadcom WPS flaw leaves routers exposed to over-the-air takeover
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Researcher Quentin Kaiser presented "WPSplinter" at Hexacon, a memory flaw in Broadcom's legacy WPS Monitor that reassembles fragmented WPS messages without a size check. It is reachable over the air before pairing, so no password or PIN is needed. He demonstrated password theft on an Askey TCG3000 and a remote shell on a Sagemcom BBOX3V+. Broadcom says it replaced the code in 2018 but assigned no CVE. The claims come from a single source and are unverified. For device makers, old firmware may still carry it.