In this article
On October 16, 2026 researcher Quentin Kaiser published WPSplinter: two bugs in the WPS implementation that Broadcom ships in its Wi-Fi SDK. The code has been in gateways since at least 2010. A crafted sequence of WPS EAP messages overflows a reassembly buffer, and an attacker within Wi-Fi range, without the network key and without ever completing WPS enrollment, reads the Wi-Fi password out of memory or runs their own code on the gateway. Broadcom told the researcher on July 28 that a patch was available to OEMs, declined to assign a CVE, and the CERT/CC case was opened and closed on August 4. As of October 15 not one of the affected devices had received an update. In Belgium alone the researcher's estimate is about 1.56 million gateways at Proximus, VOO and Orange Belgium. These boxes passed acceptance. They push the throughput they were sold for. Nobody fed them garbage.
What happened
- Two bugs, one parser. Information disclosure plus arbitrary code execution in the WPS EAP reassembly code of Broadcom's proprietary WPS stack. A 2018 partial fix did not close it, and Broadcom later advised OEMs to move to the hostapd-based SDK.
- Chipsets on eCos (BCM3380, BCM3383, BCM33834) are what the researcher calls a forever day: no update will come. Linux-based BCM3390, BCM63xx, BCM65xx and BCM68xx stay exposed until the OEM migrates its SDK.
- Devices named: Proximus BBOX 3 and BBOX3V+, VOO Netgear CG3100/CG3700 and Technicolor TC7210/CGA4233, Orange Belgium ASKEY TCG3000. The proof of concept on the TCG3000 pulls the Wi-Fi key and sends it over the air.
- Response so far: Proximus switched WPS off across its fleet within 24 hours of the report, Orange Belgium is evaluating the same, Telenet turned out not to be affected. No CVE means no scanner, no CVSS score and no line in anyone's vulnerability management report.
- The researcher notes that AI tooling cut the work from months to under a week. The attack surface did not change. The cost of finding bugs in it did.
What this means for the business
An operator buys CPE by the hundred thousand, on a tender that measures Wi-Fi coverage, throughput and price. The box that wins has a radio chip from one supplier, a Wi-Fi SDK from that same supplier, and firmware from an ODM that nobody at the operator has ever audited. When the defect sits in the SDK, the operator cannot fix it, often cannot even get a CVE to point at, and the only lever left is to disable a feature on a million homes overnight. The number to put next to the saved euros per unit is the cost of a fleet-wide emergency change and the headlines that follow. Since August 1, 2025 the EU Radio Equipment Directive makes cybersecurity a condition for selling such devices, and the Cyber Resilience Act takes over in December 2027. The regulator will ask what you tested. "It passed TR-398" will not be the answer they want.
What this means for engineers
- TR-398 measures performance. Issue 4, in force since September 2026, covers RF capability, coverage, multiple stations, stability and mesh. There is no security robustness chapter. A gateway can score top marks and fall over on one malformed EAP frame.
- Fuzz the stacks that listen before authentication. WPS, EAPOL, 802.11 management and action frames, DHCP, TR-069 and the web UI all parse attacker-controlled input. Protocol fuzzers exist for this; Defensics alone ships 6 WLAN suites covering 802.11, WPA2 and WPA3 handshakes. If your supplier cannot show fuzzing results for the exact SDK build, assume nobody ran them.
- Test the mitigation, not the checkbox. Disable WPS, reboot, factory reset, upgrade firmware, then prove with a sniffer that the gateway no longer answers WPS probes. Settings that silently come back are a known failure mode on CPE.
- Put robustness into acceptance on a real-radio testbed: traffic at full load on all bands while a fuzzer hammers the management plane. Crashes under load look different from crashes on an idle box.
- Ask for the SDK version in the bill of materials and keep it in the contract. Forever-day chips are a procurement decision, made years before the bug is public.
What to do
Add one line to your CPE acceptance program: robustness of every protocol the gateway parses before a client is authenticated, run under traffic load, with results you can show a regulator. TEST4NET will help you build that scenario into your test plan and run it on the gateway you are about to buy. Test. Compare. Decide.
Sources
Written by
Alexander Zemskov
Alexander Zemskov leads network and security testing at TEST4NET, an independent, vendor-neutral testing lab in Yerevan, Armenia. With 19+ years in performance and load testing on IXIA, Spirent, Keysight, Xena and Xinertel platforms, he runs NGFW, WAF, IPS, DLP and SASE evaluations for telecom operators, banks and system integrators.
