Broadcom Wi-Fi bug turns sweet 16, still lets strangers hijack your router

Millions of routers remain vulnerable to hijacking, potentially exposing your network and data without any action on your part.

A 16-year-old security vulnerability in Broadcom's Wi-Fi chips, known as WPSplinter, allows attackers to hijack routers without needing the Wi-Fi password. Security researcher Quentin Kaiser discovered that specially crafted Wi-Fi Protected Setup (WPS) messages could corrupt a router's memory, enabling an attacker within Wi-Fi range to execute code and steal network credentials. This flaw affects millions of devices globally, with an estimated 1.56 million routers in Belgium alone potentially vulnerable across providers like Proximus, VOO, and Orange Belgium. Broadcom was reportedly aware of the issue in 2018 and released a partial fix, but Kaiser claims it was insufficient. Some older devices may never receive a permanent fix, while others depend on manufacturers implementing workarounds like switching to open-source software, leaving many potentially exposed.

This vulnerability highlights a persistent challenge in the IoT and networking hardware sectors: the long lifecycle of embedded chips and the difficulty of patching them, especially when manufacturers rely on proprietary firmware. Broadcom's reported knowledge of the flaw since 2018 and the subsequent partial fix indicate a prioritization of existing product lines over long-term security, leaving users in a precarious position. The reliance on manufacturers to implement workarounds or provide updates, many of which may be unsupported or unpatched, underscores the inherent risks of hardware-dependent security.

The researcher's ability to leverage AI to accelerate the discovery of this decade-old vulnerability suggests a potential arms race in cybersecurity, where sophisticated tools can uncover deep-seated flaws more rapidly. This development could pressure chip manufacturers and device makers to adopt more proactive security measures and robust patching strategies, rather than relying on reactive fixes or the hope that older devices will simply be replaced.