Broadcom's Ten‑Year‑Old WPS Bug Could Still Threat Millions of Routers

A flaw discovered in Broadcom's Wi‑Fi Protected Setup (WPS) software, dating back to at least 2010, enables a nearby attacker to run arbitrary code on a router without needing the network password.

The defect resides in the segment of the WPS stack responsible for PIN exchanges. When an attacker transmits specially crafted packets, a buffer‑overrun is induced, sidestepping standard authentication and yielding low‑level control of the router.

Since Broadcom chips power a sizable portion of consumer and small‑business routers, the vulnerability could impact millions of devices globally. Altering the Wi‑Fi password or upgrading to stronger WPA encryption offers no protection, because the attack operates prior to those security layers.

Broadcom informed the researcher that the compromised module was swapped out in a 2018 software update and that the code is now deemed obsolete. The firm refused to issue a CVE, contending that the affected version is no longer present in current products.

Security analysts note that numerous routers still operate on legacy firmware that never gets updated, so the fix may never arrive for devices already deployed. In the absence of an official CVE, automated scanners are less apt to detect the problem, diminishing awareness among users and administrators.

Experts advise turning off WPS wherever the router UI permits, installing any firmware updates manufacturers have issued, and swapping out hardware that cannot be patched. Some industry voices propose that regulators should mandate more transparent disclosure of long‑standing flaws in widely used components.

The incident highlights a wider pattern in IoT security: vulnerabilities uncovered years earlier can resurface when outdated code persists. Comparable retroactive issues, like the 2017 KRACK flaw in WPA2, demonstrate how legacy implementations can serve as entry points for fresh attacks, spurring demands for stricter lifecycle management of embedded software.