A memory corruption flaw buried in Broadcom’s WPS implementation has quietly become one of the most consequential router security stories of the year. Dubbed WPSplinter by its discoverer, the bug affects the Wi-Fi Protected Setup code that Broadcom ships inside its chips — silicon the researcher says sits in millions of access points worldwide. The defect allows an attacker within range of a router’s signal to seize control of some devices, and it has no CVE identifier because Broadcom declined to request one.
- What it is: A memory overflow in Broadcom’s own WPS code, present in its development kit since at least 2010, enabling memory leaks and arbitrary code execution with admin privileges.
- Why it matters: No CVE means no standard severity score or advisory, leaving operators and enterprises without the identifiers they rely on to prioritize patching.
- Who is affected: Several router models deployed in Spain by Movistar, O2, Telefónica and MásMóvil appear on the researcher’s confirmed list, while Movistar and Orange say fixes are applied automatically.
Anatomy of a Silent Vulnerability
The flaw lives in how the router reassembles certain fragmented WPS messages. According to security researcher Quentin Kaiser, who presented his findings on October 16 at the Hexacon conference in Paris, the bug has been in Broadcom’s development kit since at least 2010. The impact ranges from leaking memory to executing arbitrary code with administrator privileges in his demonstrations.
Crucially, an attacker needs neither the Wi-Fi password nor a completed WPS pairing — only proximity to the signal. This is not a remote internet attack, despite some media characterizations, though Kaiser says it works “from the other side of the street” and at considerable distance. He found the flaw in under a week using frontier AI models working as agents, and there is no record of malicious exploitation so far.
Broadcom’s Refusal and the CVE Gap
Broadcom, which can assign CVE identifiers, refused to request one. Per Kaiser’s timeline, he notified the company on July 18 and July 27. On July 28, Broadcom replied that a patch existed and pointed him to device manufacturers. The next day it declined to request a CVE or share its advisory with manufacturers, arguing the software is obsolete and outside its support window. Kaiser adds that Broadcom had already silently published an incomplete fix in 2018 and recommended migrating to other software.
The practical fallout is serious. Without a CVE there is no severity score and no standard advisory, and many operators and enterprises depend on those identifiers to know what to patch. Kaiser classifies the BCM3380, BCM3383 and BCM33834 chips running eCos as a flaw that will never be fixed, and the BCM3390, BCM63xx, BCM65xx and BCM68xx chips running Linux as at risk of remaining unfixed if manufacturers do not update. He stresses that owning one of these chips does not by itself make a device vulnerable.
Spanish Routers in the Spotlight
The researcher’s public list confirms four models used in Spain: the Askey RTF3505VW, the MitraStar GPT-2541GNAC and the Comtrend VG8050 — deployed by Movistar, O2 and Telefónica — plus the ZTE F680 v4 from MásMóvil. The Sagemcom F@ST 5657 used by Yoigo appears as probable.
Reports have also named Orange’s Livebox Fibra, the Sagemcom Fast 5656. That claim warrants caution: on the researcher’s list the model appears as probable for Orange Poland, not Spain, and the unit shown in the presentation is from Orange France. Orange does, however, cite its Livebox among equipment with affected components. In Belgium, Kaiser demonstrated the attack on routers from three of the four operators he tested, and Proximus disabled WPS across its entire fleet within roughly 24 hours.
What Operators Say — and Why Disabling WPS Falls Short
Both Movistar and Orange say they are handling the matter. Orange told reporters it is aware of possible vulnerabilities in certain components, including its Livebox router, has not identified any exploitation, deploys fixes with its suppliers automatically, and that customers need do nothing. Telefónica says it is in contact with manufacturers to test the equipment it manages. In its official customer forum, Movistar describes a possible vulnerability in certain models and says necessary actions are taken preventively and automatically, with no need to change configuration or hardware.
Disabling WPS is not a reliable solution: on some devices, turning the option off does not disable the vulnerable code.
That warning comes from Kaiser himself. His recommendation is to ask the operator or manufacturer whether a firmware update corrects the issue. If you own your router outright and it no longer receives updates, the risk is significant — and it may be time to replace it.
The deeper problem is Broadcom. A company whose chips sit in millions of access points, by the researcher’s estimate, should not be able to decide that a code-execution flaw deserves no public identifier because the software is old. Precisely because it is old, it keeps running in countless homes. Until operators publish concrete model lists and completion dates, “you don’t need to do anything” is not the same as “it is already fixed.”