Broadcom's Ten‑Year‑Old WPS Vulnerability Could Still Threat Millions of Routers

A flaw discovered in Broadcom's Wi‑Fi Protected Setup (WPS) software, dating back to at least 2010, permits an attacker who is within Wi‑Fi range to run arbitrary code on a router without needing the network password.

The defect resides in the segment of the WPS implementation responsible for PIN exchanges. Sending specially crafted packets can cause a buffer‑overrun, sidestepping the usual authentication checks and giving the attacker low‑level control of the device.

Since Broadcom chips are incorporated into a substantial portion of consumer and small‑business routers, the vulnerability could impact millions of deployments globally. Modifying the Wi‑Fi password or switching to stronger WPA encryption does not alleviate the danger, because the exploit operates prior to those security layers.

Broadcom informed the reporting researcher that the compromised module was swapped out in a 2018 software revision and that the problematic code is now deemed obsolete. The firm refused to allocate a CVE number, contending that the affected version is no longer supported in present‑day products.

Security analysts note that numerous routers still operate on legacy firmware that never gets updated, so the fix may never be delivered to devices already deployed. In the absence of an official CVE, automated scanners are less apt to detect the problem, diminishing awareness for end users and administrators.

Experts advise turning off WPS wherever the router's interface permits, installing any firmware updates issued by manufacturers, and swapping out hardware that cannot be patched. Certain industry observers propose that regulators should mandate more transparent disclosure of long‑standing vulnerabilities in widely used components.

The incident highlights a wider pattern in IoT security: vulnerabilities found years earlier can resurface when outdated code stays in use. Comparable retroactive issues, like the 2017 KRACK flaw in WPA2, have demonstrated how legacy implementations can serve as a launch point for fresh attacks, spurring demands for stricter lifecycle management of embedded software.