Due to a vulnerability in Broadcom’s WPS implementation, attackers can execute code on routers within Wi-Fi range without knowing the password. Security researcher Quentin Kaiser demonstrated the vulnerability on gateways from Proximus, VOO, and Orange Belgium. Broadcom has been aware of the issue since 2018 but refuses to assign a CVE.
Kaiser calls the vulnerability “WPSplinter,” though he says he hates bugs with brand names. With a public documentation page, he doesn’t have to answer every question individually via email.
The flaw lies in Broadcom’s own implementation of 802.11 and, according to Kaiser, has been present in the chipmaker’s SDK since at least 2010. It involves an overflow that occurs when reassembling WPS EAP messages. An attacker doesn’t need to know the network key or complete a normal WPS registration. An attacker can exploit the vulnerability to steal information and execute arbitrary code. The bug is thus sixteen years old.
Over-the-air root shell
Kaiser demonstrated the attack on an ASKEY TCG3000 from Orange Belgium. His shellcode extracted the PSK from the NVRAM and sent it back to the attacker via 802.11. He then used that key to connect to the network. On a Proximus BBOX3V+, he obtained a reverse shell over 802.11 frames. This didn’t require a C2 server in the cloud. And no, the attack doesn’t only work if the antenna is nearby. According to Kaiser, it also works over long distances.
At VOO, the Netgear CG3100 and CG3700, the Technicolor TC7210, and the CGA4233 are vulnerable. Telenet may use vulnerable Sagemcom F@st models, but Kaiser could not obtain a sample. Based on BIPT data, he estimates the number of affected gateways at 850,000 at Proximus, 500,000 at VOO, and 210,000 at Orange.
The problem is not limited to Belgium. Globally, it involves dozens of vendors and hundreds of products. Kaiser is therefore sharing a fingerprinting script and a YARA rule to identify all affected devices.
No CVE, no patch
In 2018, Broadcom released an incomplete patch. The company subsequently recommended switching to hostapd. As a result, the vulnerability remains permanently open for eCos platforms (BCM3380, BCM3383, BCM33834). The same applies to Linux platforms (BCM3390, BCM65xx, BCM68xx), unless manufacturers make the switch. According to Kaiser, Broadcom refuses to assign a CVE or communicate publicly about the bug. He believes this is why so many OEMs have not applied the patch. CERT/CC closed its advisory on August 4, the very same day, because Broadcom itself is the CVE Numbering Authority.
Kaiser set a 90-day deadline, starting July 18. Proximus responded and held a discussion with the researcher. Orange did not respond. The Belgian Cybersecurity Center also received the report. Yet, as of October 15, not a single affected device had been updated. “This means that from across the street, you can gain a root shell on a significant portion of the routers in Belgium, and likely elsewhere as well,” writes Kaiser. Users can disable WPS in their modem’s settings.