A security researcher has identified a significant vulnerability in Broadcom’s proprietary implementation of the 802.11 wireless standard. The flaw, which has existed in Broadcom's Software Development Kit (SDK) since at least 2010, allows for remote code execution and information disclosure over WiFi. Crucially, the attack can be triggered without the attacker knowing the network key or completing a standard Wi-Fi Protected Setup (WPS) enrollment. The vulnerability affects a wide range of platforms, including those running eCos and Linux, impacting dozens of vendors and hundreds of products globally.
While Broadcom reportedly released an incomplete patch in 2018 and subsequently recommended migrating to the 'hostapd' implementation, the researcher notes that many Original Equipment Manufacturers (OEMs) have not transitioned. This has resulted in a 'forever day' scenario for several models, such as the BCM3380, BCM3383, and BCM33834. In testing, the researcher successfully demonstrated the exploit on several Belgian Internet Service Provider (ISP) gateways, obtaining a root shell and extracting pre-shared keys (PSK) from non-volatile RAM (NVRAM). These results suggest that a significant portion of the infrastructure remains vulnerable to over-the-air attacks from nearby locations.
The primary challenge in resolving this issue appears to be a breakdown in supply chain communication. Although Broadcom claims to have notified OEMs of the fix, the researcher highlights that the lack of a formal CVE (Common Vulnerabilities and Exposures) identifier prevented many manufacturers from prioritizing the update. Estimates suggest that while hundreds of thousands of devices are affected in Belgium alone, the global impact likely reaches into the hundreds of millions. Because the vulnerability is highly targeted and occurs over the air, it is particularly suited for 'nearest-neighbor' attacks, such as compromising hotel networks or residential gateways where defenders have limited visibility into the underlying hardware's security state.