Quentin Kaiser published research on 16 October, alongside a talk at Hexacon in Paris, on two memory-corruption bugs in Broadcom's proprietary WPS implementation, in the code that reassembles fragmented EAP messages.

The bug itself is serious and conventional. What happens next is neither.

What the bug gives you

It "can be triggered remotely over WiFi without knowledge of the network key or completion of a normal WPS enrollment". No password. No enrolment. No user interaction. And, Kaiser notes, "This attack works over long distances", so the usual mental image of an attacker in the car park is too generous.

The result is controlled information disclosure and then arbitrary code execution, as root, on the gateway.

He demonstrated it twice: pulling the Wi-Fi key out of an ASKEY TCG3000 supplied by Orange Belgium, and opening a reverse shell over 802.11 frames on a Sagemcom F@st BBOX3V+ supplied by Proximus.

Two reports cover two platform families. KS-20260718-02 is the eCos side: BCM3380, BCM3383, BCM33834. KS-20260727-01 is the Linux side: BCM3390, BCM65xx, BCM68xx.

The code has been in Broadcom's SDK "since at least 2010". Kaiser puts the shelf life at sixteen years.

The part that is actually new

Broadcom has known since 2018. Kaiser writes that "An incomplete patch was silently released in 2018", after which Broadcom recommended moving to hostapd.

Then: Broadcom "refused to assign a CVE to this vulnerability or to communicate publicly about it".

So Kaiser did what the process says to do and escalated. On 4 August 2026 he opened a case with CERT/CC through VINCE. It was closed the same day, because Broadcom is a CVE Numbering Authority. The vendor that declined to issue an identifier is the body with the authority to issue it, and the coordinator's role ends there.

That is the story. Not the overflow, the absence.

What an absent identifier actually costs

A CVE is not paperwork. It is the primary key that the rest of the industry joins on.

Without one, this flaw does not appear in a vulnerability scanner's output. It cannot enter CISA's exploited catalogue, because that catalogue is a list of CVE identifiers. It does not show up in a software bill of materials check, or a supplier questionnaire, or an insurer's control list. It will not generate a patch-management ticket at any organisation that generates those from feeds.

An operations team could run every tool it owns across an estate of affected gateways and come back clean, correctly, while the gateways remain exploitable over the air from the street.

We wrote on Saturday about an OpenBSD root chain whose two bugs also carry no CVE. That absence is different in kind: OpenBSD fixes through errata and does not routinely request identifiers, and the fix shipped. Here the fix did not ship and the identifier was refused by the party that fixes it.

Forever day

Kaiser's assessment is blunt about the difference between the two platform families.

For eCos, which is where the older cable gateways sit, he calls it "a definitive forever day on eCos-based platforms". There is no path to a fix for those devices.

For Linux, it is a "potential forever day", avoidable only if manufacturers migrate their Wi-Fi software to hostapd as Broadcom suggested, which is a substantial change for a shipped product with no identifier forcing anybody's hand.

His position on the state of play, as of the day before publication: "As of October 15th, 2026, none of these affected devices have been patched."

Three of Belgium's four consumer ISPs are affected on his accounting: Proximus, VOO and Orange, with Telenet unconfirmed because he could not obtain a device. He estimates more than 1.5 million Belgian gateways, and says the number beyond Belgium is larger because the manufacturers serve a wider market. He labels his own counts "napkin math" with medium confidence, which is more care than most vendors apply to theirs.

What to do

  • If you operate consumer gateways at scale, use Kaiser's fingerprinting script and YARA rule, published with the WPSplinter documentation, to find out how many of yours are affected. There is no other way to query this.
  • If you can disable WPS on an affected device, do it. The bug is in WPS message handling.
  • Do not expect your scanner to tell you. There is nothing for it to match on.
  • If you are an ISP, publish your affected-device count. Kaiser asked for exactly that, and nobody has.
  • At home, the honest answer is that you are dependent on your provider. If your gateway is an older cable model, replacement rather than patching is the likely remedy.

What is not established

  • Whether anyone is exploiting it. Kaiser reports no real-world attacks.
  • How many devices are affected worldwide. His Belgian numbers are explicitly estimates and the global figure is not attempted.
  • What the affected ISPs and manufacturers are doing. He says he has no information about measures taken, and Orange never replied.
  • Whether Telenet is affected. He could not get a device to test.
  • Whether Broadcom will reconsider the CVE. It declined twice in July and has not commented publicly.
  • The exact mechanics of each of the two bugs, which are in the talk slides rather than the post.