A flaw buried in Broadcom's proprietary 802.11 Wi-Fi stack lets an attacker within radio range run code on a vulnerable router without ever presenting a network password — and the defective code has been carried in Broadcom's software development kit since at least 2010. That is the picture painted by researcher Quentin Kaiser, who laid out the findings in a talk at the Hexacon security conference in Paris, as reported by Security Affairs.
The bug lives beneath the layer of the wireless stack where authentication happens. The vulnerable code path is reached before any credentials are ever validated, so WPA2 and WPA3 passwords offer no defence: an attacker only needs to be close enough to transmit a crafted Wi-Fi frame, which is enough to trigger code execution on the chip's embedded processor. The published report did not spell out the mechanism in greater detail beyond the flaw's below-authentication placement.
More concerning is the reach. Broadcom's SDK is not confined to one retail product family; it is licensed into consumer routers, internet-service-provider customer-premises equipment, and a broad assortment of connected devices. Code introduced around 2010 has had well over a decade to spread through that supply chain, and many of the devices carrying it receive firmware updates only when a vendor or carrier chooses to push them — if they ever do.
Equally significant is what is missing from the disclosure record. The findings reached the public through a conference talk rather than a coordinated vendor advisory, and as of initial reporting no CVE identifier had been publicly assigned, nor had any list of affected chipsets, SDK versions, or devices been published. It also remains unclear whether Broadcom has delivered an upstream fix to SDK licensees, and which manufacturers and carriers have since shipped updated firmware. Those gaps are part of the story in their own right: without a CVE to track and without a vendor fleet list, defenders cannot readily judge whether their hardware is exposed or whether a patch exists at all.
The finding inevitably invites comparison with Kr00k (CVE-2019-15126), a separate Broadcom and Cypress defect disclosed in 2019 in which data frames were mishandled after disassociation, leaking fragments of encrypted traffic. Both flaws sit in proprietary Wi-Fi silicon code that few operators can inspect, and both underscore the same structural point: the radio firmware inside everyday networking gear constitutes a software estate of its own, one that rarely surfaces in asset inventories or vulnerability-management programmes.
One general observation worth flagging for operators: gateways and access points handed out by internet-service providers, bundled as white-label hardware with broadband plans, or left unmanaged in shared office environments typically update on carrier or vendor schedules rather than owner schedules. The organisations least equipped to respond — the small firm whose router arrived from its ISP years ago, the venue still running a decade-old access point — are precisely the ones most likely to be sitting on the oldest SDK code.
Practical steps, pending an authoritative affected-device list:
- Assume exposure on unmanaged hardware. Treat ISP-issued gateways and older access points as potentially vulnerable until the carrier confirms otherwise.
- Check for firmware updates from your ISP or vendor now, and ask your provider directly whether any Broadcom Wi-Fi firmware advisory applies to your model.
- Segment networks. Keep guest, IoT, and operational devices on separate VLANs or SSIDs so a compromised access point does not hand over everything behind it.
- Prioritise refresh. Devices that cannot receive firmware updates should be scheduled for replacement rather than patched indefinitely.
Whether a CVE number has since been assigned, and whether Broadcom's licensees have shipped fixes, remains unconfirmed in public reporting. Network administrators tracking this issue should watch for an updated advisory before drawing conclusions about their own hardware.
Source: Security Affairs — "16-Year-Old Broadcom Wi-Fi Bug Lets Attackers Take Over Routers Without a Password," reporting on Quentin Kaiser's Hexacon talk.
一個深藏於 Broadcom 專有 802.11 Wi-Fi 協定堆疊中的漏洞，可令處於無線電訊號範圍內的攻擊者毋須提供任何網絡密碼，即可在有漏洞的路由器上執行代碼；而這段有缺陷的代碼，至少自 2010 年起便一直存載於 Broadcom 的軟件開發工具包（SDK）之中。這是研究員 Quentin Kaiser 所描繪的情況，他在巴黎舉行的 Hexacon 安全會議上發表了有關研究結果，據 Security Affairs 報導。
該漏洞位於無線協定堆疊中負責認證的層面之下。有漏洞的代碼路徑在任何憑證獲驗證之前便已被觸及，因此 WPA2 及 WPA3 密碼形同虛設：攻擊者只需距離足夠近，能夠傳送經精心構造的 Wi-Fi 幀，便足以觸發晶片嵌入式處理器上的代碼執行。已發表的報告除指出該漏洞位於認證層之下外，並未進一步詳細說明其運作機制。
更令人關注的是其影響範圍。Broadcom 的 SDK 並非局限於單一零售產品系列；該 SDK 已授權予家用路由器、互聯網服務供應商（ISP）的用戶端設備（CPE），以及各式各樣的聯網裝置使用。約於 2010 年引入的代碼，已有逾十年時間透過該供應鏈擴散，而許多搭載該代碼的裝置，只有在廠商或營運商決定推送時才會收到韌體更新——甚至可能從未推送。
同樣值得注意的是披露記錄中的缺失。有關研究結果是透過會議演講而非廠商協調通告的途徑公諸於世；截至初步報道為止，並未公開分配任何 CVE 編號，亦未公布受影響晶片組、SDK 版本或裝置的清單。Broadcom 是否已向上游 SDK 被授權方提供修補，以及哪些製造商及營運商其後已發佈更新韌體，目前亦未清楚。這些缺口本身亦是事件的一部分：若沒有可供追蹤的 CVE，亦沒有廠商裝置清單，防禦方將難以判斷自身硬件是否受影響，甚至修補程式是否存在。
這項發現難免令人聯想到 Kr00k（CVE-2019-15126）——一項於 2019 年披露的 Broadcom 及 Cypress 獨立缺陷，當中數據幀在解除關聯後處理不當，洩漏加密流量碎片。兩個漏洞均存在於少數營運商能夠檢視的專有 Wi-Fi 晶片代碼中，且同樣凸顯同一個結構性問題：日常網絡設備內部的無線電韌體，本身已構成一個獨立的軟件資產，而這類資產鮮少出現在資產清單或漏洞管理計劃之中。
營運商值得留意的一點是：由 ISP 發出的閘道器和接入點、以白牌硬件形式隨寬頻計劃捆綁的設備，或是在共享辦公環境中無人管理的設備，通常按營運商或廠商的時間表更新，而非由設備擁有者決定。應變能力最弱的機構——數年前由 ISP 提供路由器的小公司、仍然使用十年舊接入點的場所——恰恰最可能仍在使用最陳舊的 SDK 代碼。
在權威受影響裝置清單出台之前，建議採取以下實際措施：
- 假定未受管理的硬件均受影響。 在營運商確認之前，應將 ISP 發出的閘道器及較舊的接入點視為可能存在漏洞。
- 立即檢查 ISP 或廠商是否提供韌體更新，並直接向服務供應商查詢其型號是否涉及任何 Broadcom Wi-Fi 韌體通告。
- 網絡分段。 將訪客、物聯網及運作設備置於獨立的 VLAN 或 SSID 上，以免單一接入點被攻陷後連帶暴露其後全部設備。
- 優先更新換代。 無法接收韌體更新的設備，應安排更換，而非無限期等待修補。
CVE 編號是否已於其後分配，以及 Broadcom 的被授權方是否已發佈修補，目前均未獲公開報道證實。跟進此事件的網絡管理員，宜密切留意後續更新通告，然後才對自身硬件作出判斷。
資料來源：Security Affairs —〈16-Year-Old Broadcom Wi-Fi Bug Lets Attackers Take Over Routers Without a Password〉，報道 Quentin Kaiser 於 Hexacon 的演講內容。