Unpatched Broadcom WPS Flaw Lets Nearby Attackers Run Code as Root on Routers

Attack path

A flaw in Broadcom's version of Wi-Fi Protected Setup, or WPS, lets an attacker within radio range run code as root on Broadcom-based routers without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. Broadcom's code mishandles reassembly of fragmented WPS setup messages, so crafted messages can corrupt router memory. Kaiser built a way to read memory back from the device and a way to run his own code on it.

Against an Orange Belgium gateway, the Askey TCG3000 read the stored Wi-Fi password, or PSK, sent it back over the air, and then joined the network with it. Against a Proximus gateway, the Sagemcom-built BBOX3V+, the exploit opened a reverse shell, a remote command line carried over Wi-Fi frames, so no outside server was needed. Both demonstrations ran without login, and Kaiser says the attack works at a distance, not only up close. He reports no real-world attacks using the flaw and says the working exploits are his own.

Affected devices

Broadcom's WPS code is embedded in routers and access points from dozens of vendors, and Kaiser estimates that millions of devices worldwide are affected. The vulnerable chips fall into two families. Older eCos-based models include the BCM3380, BCM3383 and BCM33834; Kaiser found no usable fix and calls the bug a permanent forever day, meaning a flaw that will never be patched on those devices. Newer Linux-based models include the BCM3390, BCM65xx and BCM68xx, which could be fixed if their makers switch Wi-Fi software.

In Belgium, Kaiser found the flaw present and exploitable on gateways from three of the four big providers: Proximus, Orange Belgium and VOO. A fourth provider, Telenet, may be affected too, but he could not test one. A wider list he published, ranging from Cisco small-business access points to Huawei and ARRIS routers, mixes confirmed and unconfirmed entries, and some rest on an automated check that only flags a device as likely vulnerable. He says the Belgian per-provider counts run into the hundreds of thousands of gateways, but are rough estimates.

No patch and no CVE

Kaiser traces the code back to at least 2010 and says Broadcom shipped an incomplete fix in 2018, then told customers to switch to a different Wi-Fi software package, called hostapd, rather than relying on the fix. On the older eCos chips, he says, no working fix was ever shipped, which is why he calls it a forever day. No CVE, the tracking identifier that lets defenders and vendors follow a flaw, has been assigned to it. The Hacker News found no CVE for the flaw as of October 19.

Kaiser says Broadcom told him it has known about the bug since 2018 and had heard about it from others, but would not register a CVE or say anything publicly, which he believes is why so many device makers never patched. When he took the case to the CERT Coordination Center, it was closed the same day, because Broadcom itself holds the authority to assign CVEs for its products and would not do so.

Defender guidance

There is no patch to install, and Kaiser points to no setting that blocks the attack over the air. What he provides instead is a way to find affected gear: YARA rules that spot the vulnerable code in extracted firmware, and a script that listens to a live access point and reports whether it looks vulnerable. Both are triage aids; he notes a patched device can still match the rules, so a hit is a reason to check further, not a confirmed finding. For gear that will never be fixed, replacement is the practical option. Kaiser frames the bug as well suited to attackers who reach a target over nearby Wi-Fi rather than the internet, a technique Russian state hackers have used to breach networks from across the street.

Sources: The Hacker News