Critical Broadcom Wi-Fi Vulnerability Exposes Routers to Unauthenticated Root Access

The flaw exists in Broadcom's Wi-Fi provisioning software, the component that handles the initial setup and configuration of wireless routers. An attacker positioned within radio range of a vulnerable router can trigger code execution with root-level privileges without providing the network's Wi-Fi password or performing any pairing handshake. This means the attacker does not need to be connected to the network or possess any legitimate access credentials. Once code runs as root, the attacker gains complete control: they can read stored credentials, reconfigure the device, inject malware, redirect traffic or use the compromised router as a pivot point into the home network.

Kaiser's proof-of-concept demonstration specifically showed the extraction of Wi-Fi passwords from routers deployed by Belgian internet service providers, illustrating that the vulnerability has real-world impact on end-user devices in production.

Router compromises are particularly dangerous because the device sits at the perimeter of your home network and has visibility into all traffic flowing to and from your devices. A rooted router can perform DNS hijacking, SSL stripping, credential interception and malware injection without the user noticing. For users on the same network or passing through the compromised device, the attacker can intercept unencrypted communications, capture login credentials and monitor which websites and services the household accesses.

Broadcom Wi-Fi chipsets are used in devices sold by multiple internet providers globally, so the actual exposure is broad. Home users typically cannot patch their ISP-supplied equipment themselves; they depend on their provider to issue and deploy firmware updates. The public disclosure means that attackers now have detailed information about the flaw and can begin crafting targeted exploits, especially against users whose ISP has not yet released a patch.

The vulnerability operates within the Wi-Fi provisioning phase, the process that happens when a router is first set up or when a user attempts to connect a new Wi-Fi device. The affected Broadcom firmware does not properly validate or authenticate commands sent during this phase. An attacker can craft malicious provisioning requests and transmit them to the router over the air. Because these requests are processed before normal authentication checks, the attacker's code runs with root permissions.

The attack requires the attacker to be in radio range of the target router, typically a distance of 30 to 100 meters depending on environmental factors and the antenna configuration. No interaction from the user is required; the router's vulnerable software processes the malicious request automatically. Once the code executes, the attacker can establish a persistent connection, extract the pre-shared Wi-Fi key or any other sensitive data stored in the device, and maintain access for future attacks.

The flaw affects routers and home gateways that use Broadcom's Wi-Fi chipsets and run the vulnerable provisioning software. Kaiser's disclosure specifically named devices supplied by three Belgian internet providers, but Broadcom components are embedded in equipment from manufacturers and service providers worldwide. Internet providers in Europe, North America and other regions typically supply Broadcom-based gateways to residential customers.

To determine if your router is vulnerable, check the device documentation or contact your internet service provider to confirm whether your router uses a Broadcom Wi-Fi chipset. ISPs have begun releasing patches, but availability varies by region and device model. The lack of a public CVE identifier at the time of disclosure creates a challenge for automated vulnerability tracking; users must rely on guidance from their provider.

If you are a home user with an ISP-supplied router, take these steps:

1. Contact your internet service provider and ask whether your router model is affected by the Broadcom Wi-Fi provisioning vulnerability and whether a patch is available.
2. Check the router's web interface (typically accessed via a browser at 192.168.1.1 or 192.168.0.1) for firmware update options and install any available updates immediately.
3. If your router supports it, move the Wi-Fi provisioning into a locked or disabled mode so that only authorized devices can pair with the network.
4. Consider enabling WPA3 encryption if your router supports it, as it offers stronger protection against certain attack vectors compared to WPA2.
5. Minimize the broadcast power of your Wi-Fi network if your router allows it, reducing the distance at which an attacker can attempt the exploit.
6. Monitor your router's logs for unusual connection attempts or administrative access, though note that a fully compromised router may hide evidence of its own compromise.

This vulnerability underscores a common problem in the ISP equipment ecosystem: devices are often deployed with firmware that receives infrequent updates, and users have limited visibility into the security status of their own hardware. When a router is controlled by an internet provider rather than owned outright by the customer, the customer cannot independently patch or replace the device without provider permission. Public disclosure of flaws in widely-deployed equipment creates a window of exposure for users who cannot act quickly.

The fact that code can run as root without authentication represents a critical severity level. Attackers do not need to exploit multiple chained vulnerabilities or social-engineer the user. The radio-based attack surface means that anyone with modest technical knowledge and inexpensive equipment can attempt the exploit from a distance. Security researchers and law-enforcement agencies have documented increasing use of compromised home routers for botnet recruitment, malware distribution and surveillance.

What if I don't know whether my router uses Broadcom Wi-Fi chips?

Start by checking the router's label or manual for the chipset model, or log into the device's web interface and look for firmware or hardware information. Your internet service provider's support team can confirm whether your specific model is affected by the Broadcom provisioning vulnerability.

Can I protect myself if a patch isn't available yet?

Partial mitigations include disabling Wi-Fi provisioning features if your router supports it, changing the default administrative password if you have access to the configuration interface, and monitoring your network for unusual traffic. These do not eliminate the risk, but they reduce the likelihood of successful exploitation.

Does this vulnerability require the attacker to know my Wi-Fi password?

No. The entire point of the vulnerability is that an attacker can run code before the normal authentication check that would require the password. The attacker can then extract the password from the device's memory.

Can this vulnerability be exploited through the internet from outside my home?

No. The attack requires radio-frequency proximity to the router. An attacker cannot trigger it remotely over the internet, but they could potentially compromise the router if they are physically near your home or business and have technical equipment.

Should I replace my router if my ISP won't patch it?

If your service provider confirms the vulnerability affects your device and no patch is forthcoming, replacing the router with a third-party model you control and can patch independently is the most secure long-term option. Many users install their own routers alongside ISP equipment to avoid such dependency.

Source: The Hacker News