A Radio-Range Attack With No Password Required
A researcher has disclosed an unpatched vulnerability in Broadcom's Wi-Fi setup software that allows an attacker within radio range to execute code with root privileges on Broadcom-based routers — without knowing the network password and without completing any pairing step.
Quentin Kaiser published the details on October 16, and demonstrated the attack against home gateways issued by three Belgian internet service providers. In at least one of those cases, he was able to read the Wi-Fi password directly off the device, according to The Hacker News.
Why This Matters
The severity here comes from the combination of three factors:
- Proximity is the only prerequisite. The attacker needs to be within Wi-Fi range, not on the network.
- No credentials are needed. The flaw sits in the setup/onboarding path, which by design must be reachable by devices that are not yet trusted.
- The impact is root. Code execution at the highest privilege level on the gateway means full control of the device, not a limited information leak.
Home gateways are the boundary between a household or small business network and the internet. A compromised router can be used to intercept traffic, redirect DNS, tamper with firmware, or serve as a persistent foothold that survives reboots and endpoint cleanup.
A Familiar Pattern in Provisioning Code
Broadcom silicon and reference software underpin a very large share of consumer and ISP-supplied routers and access points worldwide. That breadth means a flaw in a shared setup component can propagate across many OEM brands and carrier-specific firmware builds — even where the underlying hardware looks different on the outside.
The disclosure also highlights a recurring problem in embedded networking: the pre-authentication onboarding channel is often the least hardened part of the stack. Setup protocols frequently predate modern threat models, are implemented inconsistently by OEMs, and are difficult to patch because firmware updates pass through silicon vendors, device manufacturers, and ISPs in sequence.
Patch Status and Exposure
As of the disclosure, the issue remains unpatched. That is the critical operational fact for defenders: there is no vendor fix to deploy, so risk reduction has to come from configuration, segmentation, and monitoring rather than from a firmware update.
Because the affected devices are typically ISP-supplied, many end users cannot simply patch them. Remediation depends on the carrier pushing updated firmware, which makes the vendor-to-ISP pipeline the real bottleneck.
What Defenders and Users Can Do
Until a fix lands, the practical guidance is defensive:
- Reduce physical and radio exposure. Place access points away from windows and exterior walls where feasible, and lower transmit power where coverage allows. This shrinks the attacker's usable range.
- Ask the ISP. For carrier-supplied gateways, contact the provider and ask whether the model is affected and when firmware is expected. Track the answer; this is the only path to a real fix for most households.
- Segment the network. Put IoT and guest devices on a separate SSID or VLAN so that a gateway compromise is not immediately adjacent to primary workstations and storage.
- Watch for anomalies. Unexpected admin logins, unexplained configuration changes, new DNS settings, or unfamiliar devices in the DHCP lease table are worth investigating. Enable logging where the firmware supports it.
- Consider a replacement where justified. Organizations with high-value networks behind consumer-grade gateways should weigh whether a device with a stronger security-update track record is warranted.
The Bigger Lesson
This disclosure is a reminder that the perimeter is not only the firewall — it is also the radio. Setup protocols that must accept unauthenticated input deserve the same scrutiny as internet-facing services, and the multi-party firmware supply chain means that a single flaw can stay live in the field long after it is publicly known.
For now, the vulnerability is public, the exploit is demonstrated, and the fix is pending. Organizations should treat Broadcom-based gateways in their inventory as elevated-risk assets and plan accordingly.
Source: The Hacker News — Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers
