Broadcom Wi-Fi Bug Has No CVE and No Patch on Belgian Gateways

An attacker within Wi-Fi range of a Broadcom-based cable gateway can run code on it without knowing the network key or finishing a WPS enrollment, and Broadcom has declined to assign a CVE. Security researcher Quentin Kaiser published the details on Oct. 16, 2026, saying none of the affected devices has been patched.

The flaw is a WPS EAP fragment reassembly overflow in Broadcom's proprietary 802.11 SDK. Kaiser's post says it has been in that code since at least 2010, and calls it a "definitive forever day" on eCos-based chipsets.

What the bug needs and what it gives

Kaiser presented the work at the Hexacon conference in Paris on Oct. 16. The preconditions are short: the attacker needs to be in radio range, and the post says the attack works over long distances, not only at close range. It does not need the pre-shared key.

The impact is controlled information disclosure and arbitrary code execution. In the two demonstrations Kaiser describes, the attacker has unauthenticated remote code execution on the access point itself.

• Orange Belgium ASKEY TCG3000: shellcode read the pre-shared key from NVRAM, sent it back over 802.11 frames, and the attacker joined the network with it.
• Proximus BBOX3V+: a reverse shell carried over 802.11 frames.

A gateway that hands its Wi-Fi password to someone outside the building is a different class of problem from a bug in a login page. The attack runs over the radio link, so it does not depend on whether the gateway's management page is exposed to the internet. The AA26-281A advisory on old CVEs dealt with old CVEs and the known-exploited catalogue; this bug has no CVE for such a catalogue to track.

Who is affected, by Kaiser's estimate

Kaiser lists eCos-based chipsets BCM3380, BCM3383 and BCM33834 as definitively affected. Linux-based BCM3390, BCM65xx and BCM68xx are a "potential forever day" unless device makers migrate. The post says dozens of vendors, hundreds of products and millions of access points are affected.

Operator	Affected models	Gateways (Kaiser's estimate)
Proximus	BBOX 3, BBOX3V+	850,000
VOO (legacy)	Netgear CG3100, CG3700; Technicolor TC7210; CGA4233	500,000
Orange Belgium	ASKEY TCG3000	210,000
Telenet	F@ST3896LG, F@ST5685LGB (untested)	Unknown

Kaiser describes those unit counts as napkin math at medium confidence. They are one researcher's estimate, not operator figures.

1. Proximus850K gateways
2. VOO (legacy)500K gateways
3. Orange Belgium210K gateways

Source: Quentin Kaiser, Oct. 16, 2026 (researcher's own estimate, medium confidence)

Kaiser's broadcom-wps repository on GitHub carries a wider device table that goes beyond Belgium. It names vendors including ARRIS, Askey, Comtrend, Netgear, Sagemcom, TP-Link, ZTE and Zyxel, and maps some models to KPN, Türk Telekom and Movistar. The README says "THIS LIST IS NOT EXHAUSTIVE" and that its author expects the list to reach thousands of models. Several entries, including some Huawei and Tenda models, are marked unconfirmed.

Disclosure timeline, July to October 2026

Kaiser says he followed a 90-day disclosure policy.

• July 18: report KS-20260718-02 sent to Broadcom's PSIRT, covering eCos platforms.
• July 27: report KS-20260727-01 sent, covering Linux platforms.
• July 28: Broadcom replied that a patch exists and told him to contact manufacturers.
• July 29: Broadcom declined to register a CVE or share its notification to device makers. Kaiser sent a detailed report to Proximus and a report and toolkit to the Cyber Security Center Belgium.
• Aug. 4: a CERT/CC case was opened through VINCE and closed the same day.
• Oct. 16: public talk at Hexacon.

The post says CERT/CC closed its case because Broadcom is itself a CVE Numbering Authority. That is the mechanism behind the missing identifier: the company that wrote the code decides whether it gets one.

What the patch status actually is

Kaiser says Broadcom released an incomplete patch quietly in 2018, then recommended that vendors move to hostapd, the open-source access point daemon. Broadcom told him a patch is available. As of Oct. 15, he writes, "none of these affected devices have been patched."

He also says he has no information about what operators or device makers have done. There is no statement from Broadcom, Proximus or Orange Belgium in the sources for this story. The only record of Broadcom's replies is Kaiser's own timeline.

Kaiser says AI models cut the discovery from months to under a week. That claim is his alone. For the firmware side of Wi-Fi bugs, see also the Esp32sim WiFi emulation piece.

The workaround is thin. Kaiser's fingerprinting script and YARA rules identify affected devices, and the post does not describe a configuration change that closes the hole. Anyone with a monitor-mode Wi-Fi interface can check a gateway with the script, and firmware analysts can run the YARA rules, which the README calls "triage aids" that compiler changes can evade. The script reports "LIKELY_VULNERABLE" when two signals agree: a Broadcom proprietary information element and a behavioural difference from hostapd on a zero-length fragmented frame. The next milestone is a firmware update from Proximus, VOO or Orange Belgium; none had been announced in Kaiser's post.