Security researcher Quentin Kaiser has revealed a significant vulnerability in Broadcom's Wi-Fi setup software that allows attackers within radio range to execute code with root privileges on Broadcom-based routers. This exploit does not require the network password or any prior pairing, making it particularly dangerous. Kaiser demonstrated the flaw on routers provided by three major Belgian internet service providers. In one instance, he was able to extract the Wi-Fi password from the device, while in another, he opened a remote shell without needing an external server. Despite the severity of the flaw, no Common Vulnerabilities and Exposures (CVE) identifier has been assigned, and no fixes have been implemented on the affected devices.

The vulnerability originates from Broadcom's implementation of the Wi-Fi Protected Setup (WPS) feature, which mishandles fragmented setup messages, allowing memory corruption. Kaiser's tests showed that millions of devices worldwide could potentially be affected, with vulnerabilities found in both older eCos-based models and newer Linux-based ones. While the latter could be patched if manufacturers switch to a different Wi-Fi software package, the former are likely to remain unpatched, earning the label 'forever day'. In Belgium alone, the flaw affects routers from Proximus, Orange Belgium, and VOO, with potential impacts on hundreds of thousands of gateways.

The flaw has been traced back to at least 2010, and although Broadcom provided a partial fix in 2018, it advised customers to switch to a different software package. Kaiser points out that Broadcom has been aware of the issue since 2018 but has not publicly disclosed it or registered a CVE. This lack of action has left many devices vulnerable, as manufacturers were not prompted to issue patches. Kaiser has provided tools for identifying vulnerable devices, but for those that cannot be patched, replacement remains the best course of action.