--- title: A 16-year-old bug in Broadcom WPS still opens 1.5 million gateways. Throughput tests never saw it description: "WPSplinter: two memory bugs in Broadcom's WPS code, no CVE, no patched device as of October 15. Why CPE acceptance needs protocol fuzzing, not only TR-398." image: https://test4net.com/hubfs/blog-covers/wpsplinter-broadcom-wps-bug-cpe-acceptance-needs-protocol-fuzzing.png --- [Skip to content](https://test4net.com/blog/wpsplinter-broadcom-wps-bug-cpe-acceptance-needs-protocol-fuzzing#main-content) [![TEST4NET](https://test4net.com/hubfs/test4net-logo-fixed-2.svg)](https://test4net.com/?hsLang=en) - Services - Products - Resources - Company [News](https://test4net.com/news?hsLang=en) [Login](https://lab.test4net.com) [Support](https://test4net.com/support?hsLang=en) What we test By technology Industries [Load & Performance Testing Throughput, sessions and latency up to and past the rated limit](https://test4net.com/services/load-performance-testing?hsLang=en) [Functional & Conformance Testing Features against the spec, RFC compliance with evidence](https://test4net.com/services/functional-conformance-testing?hsLang=en) [Interoperability Testing Multi-vendor behaviour, before it reaches production](https://test4net.com/services/interoperability-testing?hsLang=en) [Security & Resilience Testing NGFW, IPS and VPN efficacy and performance with threats on the wire](https://test4net.com/services/security-resilience-testing?hsLang=en) [Test Plan & Methodology Design What to test, how, and what counts as a pass](https://test4net.com/services/test-plan-design?hsLang=en) [Test Automation & CI/CD Regression suites wired into your release pipeline](https://test4net.com/services/test-automation?hsLang=en) [Training Programs Hands-on courses for your test engineers](https://test4net.com/services/training-programs?hsLang=en) [Equipment Repair Repair and verification of test equipment](https://test4net.com/services/equipment-repair?hsLang=en) [All services](https://test4net.com/services?hsLang=en) [Routing & Switching RFC 2544 and RFC 2889 on real ports, 1G to 100G](https://test4net.com/solutions/routing-switching?hsLang=en) [Firewalls & NGFW RFC 9411 throughput with inspection switched on](https://test4net.com/solutions/firewalls-ngfw?hsLang=en) [Load Balancers & ADC Connections, TLS and failover of the pair under load](https://test4net.com/solutions/load-balancers-adc?hsLang=en) [SD-WAN & WAN Path selection and QoS under emulated WAN conditions](https://test4net.com/solutions/sd-wan?hsLang=en) [Cloud & NFV Virtual appliances and cloud services under load](https://test4net.com/solutions/cloud-nfv?hsLang=en) [5G & Mobile Core Transport and core functions under subscriber traffic](https://test4net.com/solutions/5g-mobile-core?hsLang=en) [Wi-Fi Wi-Fi 6 clients and access points, Wi-Fi 7 in progress](https://test4net.com/solutions/wi-fi?hsLang=en) [Storage & Infrastructure Storage networks and servers under realistic I/O](https://test4net.com/solutions/storage?hsLang=en) [AI / Switching Fabric (RoCEv2) Lossless Ethernet for GPU clusters: PFC, ECN, fabric load](https://test4net.com/solutions/ai-fabric-rocev2?hsLang=en) [All technologies](https://test4net.com/services#coverage) [Telecom Operators Pre-deployment acceptance and vendor comparison](https://test4net.com/solutions/industries#telecom) [Network & Security Vendors Independent validation of your product claims](https://test4net.com/solutions/industries#vendors) [System Integrators Proof for the customer before the rollout](https://test4net.com/solutions/industries#integrators) [Enterprise & Banks Upgrades and new platforms checked before production](https://test4net.com/solutions/industries#enterprise) [All industries](https://test4net.com/solutions/industries?hsLang=en) Not sure where to start? Test plan and quote in 1–3 business days Tell us what you run and what worries you. We propose the tests, tools and timeline. [Request a test plan](https://test4net.com/contacts?hsLang=en) CloudLAB [How It Works Pick a scenario, run it in the live lab, get the report](https://test4net.com/cloudlab#how) [Equipment & Capabilities L2-3 to 100G, L4-7 past 200G, Wi-Fi, WAN emulation](https://test4net.com/cloudlab#equipment) [Access Plans Hourly sessions, subscriptions, dedicated racks](https://test4net.com/cloudlab/plans?hsLang=en) [Hosted DUT Testing Ship the box or upload the VM, we run the tests](https://test4net.com/cloudlab/hosted-dut?hsLang=en) [Open the CloudLAB portal](https://lab.test4net.com) Our tools [Traffic Generator L4-7 and security traffic past 200 Gbit/s, app mix library](https://test4net.com/products/traffic-generator?hsLang=en) [WANemu Delay, jitter, loss and bandwidth shaping per link](https://test4net.com/products/wanemu?hsLang=en) [Book a demo](https://test4net.com/contacts?hsLang=en) New: our own test tools Our own tools, in beta this autumn Built in our lab, priced per gigabit. Join the beta list and see them first. [Join the beta list](https://test4net.com/products#lead-form) Read Technologies / Protocols Methodologies [Blog Case studies, test insights and lab notes](https://test4net.com/blog?hsLang=en) [Industry News What is changing in network testing and infrastructure](https://test4net.com/news?hsLang=en) [FAQ How the lab, sessions and reports work](https://test4net.com/faq?hsLang=en) [Glossary Network testing terms in plain words](https://test4net.com/glossary?hsLang=en) [All resources](https://test4net.com/resources?hsLang=en) [BGP Route exchange, policy and convergence](https://test4net.com/blog/how-we-test-bgp?hsLang=en) [OSPF & IS-IS IGP adjacency, flooding and SPF timing](https://test4net.com/blog/how-we-test-ospf-is-is?hsLang=en) [MPLS & SR LDP, RSVP‑TE and SR‑MPLS label paths](https://test4net.com/blog/how-we-test-mpls-and-segment-routing?hsLang=en) [EVPN / VXLAN Overlay fabrics, MAC/IP routes, multi-homing](https://test4net.com/blog/how-we-test-evpn-vxlan?hsLang=en) [IPsec & IKEv2 Tunnel setup, rekeying and throughput](https://test4net.com/blog/how-we-test-ipsec-and-ikev2?hsLang=en) [TLS / HTTPS Handshakes, cipher suites and inspection](https://test4net.com/blog/how-we-test-tls-and-https?hsLang=en) [RoCEv2 Lossless Ethernet, PFC and ECN for AI fabrics](https://test4net.com/blog/how-we-test-rocev2?hsLang=en) [Wi-Fi 6 / 6E / 7 802.11ax/be, OFDMA, MLO and roaming](https://test4net.com/blog/how-we-test-wi-fi-6-6e-7?hsLang=en) [All protocols](https://test4net.com/blog/tag/protocols?hsLang=en) [RFC 2544 Throughput, latency, frame loss and back-to-back](https://test4net.com/methodologies/rfc-2544?hsLang=en) [RFC 2889 LAN switch benchmarking: forwarding, MAC learning, congestion](https://test4net.com/methodologies/rfc-2889?hsLang=en) [RFC 9411 / RFC 3511 Firewall and NGFW performance benchmarking](https://test4net.com/methodologies/rfc-9411-rfc-3511?hsLang=en) [RFC 6349 TCP throughput and buffer delay testing](https://test4net.com/methodologies/rfc-6349?hsLang=en) [RFC 5180 IPv6 benchmarking methodology](https://test4net.com/methodologies/rfc-5180?hsLang=en) [ITU-T Y.1564 Ethernet service activation: CIR, EIR, KPIs per service](https://test4net.com/methodologies/y-1564?hsLang=en) [ITU-T Y.1731 Ethernet OAM: delay, jitter, loss and SLA monitoring](https://test4net.com/methodologies/y-1731?hsLang=en) [TR-398 Wi-Fi in-premises performance test plan](https://test4net.com/methodologies/tr-398?hsLang=en) [All methodologies](https://test4net.com/methodologies?hsLang=en) Read [Case studies, test insights and lab notes Blog](https://test4net.com/blog?hsLang=en) [What is changing in network testing and infrastructure Industry News](https://test4net.com/news?hsLang=en) [How the lab, sessions and reports work FAQ](https://test4net.com/faq?hsLang=en) [Network testing terms in plain words Glossary](https://test4net.com/glossary?hsLang=en) [About Us Independent lab in Armenia, team and history](https://test4net.com/about?hsLang=en) [Why TEST4NET What you get that vendor slides never show](https://test4net.com/why-test4net?hsLang=en) [Lab & Certifications Bench capacity, methods and the standards we test against](https://test4net.com/lab?hsLang=en) [Partners Test tool vendors and IT partners we work with](https://test4net.com/partners?hsLang=en) [Contacts Talk to an engineer, not a sales bot](https://test4net.com/contacts?hsLang=en) [Support portal](https://test4net.com/support?hsLang=en) - Services What we test [Load & Performance Testing](https://test4net.com/services/load-performance-testing?hsLang=en) [Functional & Conformance Testing](https://test4net.com/services/functional-conformance-testing?hsLang=en) [Interoperability Testing](https://test4net.com/services/interoperability-testing?hsLang=en) [Security & Resilience Testing](https://test4net.com/services/security-resilience-testing?hsLang=en) [Test Plan & Methodology Design](https://test4net.com/services/test-plan-design?hsLang=en) [Test Automation & CI/CD](https://test4net.com/services/test-automation?hsLang=en) [Training Programs](https://test4net.com/services/training-programs?hsLang=en) [Equipment Repair](https://test4net.com/services/equipment-repair?hsLang=en) [All services](https://test4net.com/services?hsLang=en) By technology [Routing & Switching](https://test4net.com/solutions/routing-switching?hsLang=en) [Firewalls & NGFW](https://test4net.com/solutions/firewalls-ngfw?hsLang=en) [Load Balancers & ADC](https://test4net.com/solutions/load-balancers-adc?hsLang=en) [SD-WAN & WAN](https://test4net.com/solutions/sd-wan?hsLang=en) [Cloud & NFV](https://test4net.com/solutions/cloud-nfv?hsLang=en) [5G & Mobile Core](https://test4net.com/solutions/5g-mobile-core?hsLang=en) [Wi-Fi](https://test4net.com/solutions/wi-fi?hsLang=en) [Storage & Infrastructure](https://test4net.com/solutions/storage?hsLang=en) [AI / Switching Fabric (RoCEv2)](https://test4net.com/solutions/ai-fabric-rocev2?hsLang=en) [All technologies](https://test4net.com/services#coverage) Industries [Telecom Operators](https://test4net.com/solutions/industries#telecom) [Network & Security Vendors](https://test4net.com/solutions/industries#vendors) [System Integrators](https://test4net.com/solutions/industries#integrators) [Enterprise & Banks](https://test4net.com/solutions/industries#enterprise) [All industries](https://test4net.com/solutions/industries?hsLang=en) [Not sure where to start? Test plan and quote in 1–3 business days](https://test4net.com/contacts?hsLang=en) - Products CloudLAB [How It Works](https://test4net.com/cloudlab#how) [Equipment & Capabilities](https://test4net.com/cloudlab#equipment) [Access Plans](https://test4net.com/cloudlab/plans?hsLang=en) [Hosted DUT Testing](https://test4net.com/cloudlab/hosted-dut?hsLang=en) [Open the CloudLAB portal](https://lab.test4net.com) Our tools [Traffic Generator](https://test4net.com/products/traffic-generator?hsLang=en) [WANemu](https://test4net.com/products/wanemu?hsLang=en) [Book a demo](https://test4net.com/contacts?hsLang=en) [New: our own test tools Our own tools, in beta this autumn](https://test4net.com/products#lead-form) - Resources Read [Blog](https://test4net.com/blog?hsLang=en) [Industry News](https://test4net.com/news?hsLang=en) [FAQ](https://test4net.com/faq?hsLang=en) [Glossary](https://test4net.com/glossary?hsLang=en) [All resources](https://test4net.com/resources?hsLang=en) Technologies / Protocols [BGP](https://test4net.com/blog/how-we-test-bgp?hsLang=en) [OSPF & IS-IS](https://test4net.com/blog/how-we-test-ospf-is-is?hsLang=en) [MPLS & SR](https://test4net.com/blog/how-we-test-mpls-and-segment-routing?hsLang=en) [EVPN / VXLAN](https://test4net.com/blog/how-we-test-evpn-vxlan?hsLang=en) [IPsec & IKEv2](https://test4net.com/blog/how-we-test-ipsec-and-ikev2?hsLang=en) [TLS / HTTPS](https://test4net.com/blog/how-we-test-tls-and-https?hsLang=en) [RoCEv2](https://test4net.com/blog/how-we-test-rocev2?hsLang=en) [Wi-Fi 6 / 6E / 7](https://test4net.com/blog/how-we-test-wi-fi-6-6e-7?hsLang=en) [All protocols](https://test4net.com/blog/tag/protocols?hsLang=en) Methodologies [RFC 2544](https://test4net.com/methodologies/rfc-2544?hsLang=en) [RFC 2889](https://test4net.com/methodologies/rfc-2889?hsLang=en) [RFC 9411 / RFC 3511](https://test4net.com/methodologies/rfc-9411-rfc-3511?hsLang=en) [RFC 6349](https://test4net.com/methodologies/rfc-6349?hsLang=en) [RFC 5180](https://test4net.com/methodologies/rfc-5180?hsLang=en) [ITU-T Y.1564](https://test4net.com/methodologies/y-1564?hsLang=en) [ITU-T Y.1731](https://test4net.com/methodologies/y-1731?hsLang=en) [TR-398](https://test4net.com/methodologies/tr-398?hsLang=en) [All methodologies](https://test4net.com/methodologies?hsLang=en) Read [Blog Case studies, test insights and lab notes](https://test4net.com/blog?hsLang=en) [Industry News What is changing in network testing and infrastructure](https://test4net.com/news?hsLang=en) [FAQ How the lab, sessions and reports work](https://test4net.com/faq?hsLang=en) [Glossary Network testing terms in plain words](https://test4net.com/glossary?hsLang=en) - Company [About Us](https://test4net.com/about?hsLang=en) [Why TEST4NET](https://test4net.com/why-test4net?hsLang=en) [Lab & Certifications](https://test4net.com/lab?hsLang=en) [Partners](https://test4net.com/partners?hsLang=en) [Contacts](https://test4net.com/contacts?hsLang=en) [News](https://test4net.com/news?hsLang=en) [Login](https://lab.test4net.com) [Support](https://test4net.com/support?hsLang=en) [All news](https://test4net.com/news?hsLang=en) [News](https://test4net.com/news?hsLang=en) # A 16-year-old bug in Broadcom WPS still opens 1.5 million gateways. Throughput tests never saw it ![](https://test4net.com/hubfs/IMG_0070.jpg) [Alexander Zemskov](https://test4net.com/blog/author/az) October 30, 2026 5 min read ![A 16-year-old bug in Broadcom WPS still opens 1.5 million gateways. Throughput tests never saw it](https://test4net.com/hs-fs/hubfs/blog-covers/wpsplinter-broadcom-wps-bug-cpe-acceptance-needs-protocol-fuzzing.png?width=1600&height=900&name=wpsplinter-broadcom-wps-bug-cpe-acceptance-needs-protocol-fuzzing.png) In this article On October 16, 2026 researcher Quentin Kaiser published WPSplinter: two bugs in the WPS implementation that Broadcom ships in its Wi-Fi SDK. The code has been in gateways since at least 2010. A crafted sequence of WPS EAP messages overflows a reassembly buffer, and an attacker within Wi-Fi range, without the network key and without ever completing WPS enrollment, reads the Wi-Fi password out of memory or runs their own code on the gateway. Broadcom told the researcher on July 28 that a patch was available to OEMs, declined to assign a CVE, and the CERT/CC case was opened and closed on August 4. As of October 15 not one of the affected devices had received an update. In Belgium alone the researcher's estimate is about 1.56 million gateways at Proximus, VOO and Orange Belgium. These boxes passed acceptance. They push the throughput they were sold for. Nobody fed them garbage. ## What happened - **Two bugs, one parser.** Information disclosure plus arbitrary code execution in the WPS EAP reassembly code of Broadcom's proprietary WPS stack. A 2018 partial fix did not close it, and Broadcom later advised OEMs to move to the hostapd-based SDK. - **Chipsets on eCos** (BCM3380, BCM3383, BCM33834) are what the researcher calls a forever day: no update will come. Linux-based BCM3390, BCM63xx, BCM65xx and BCM68xx stay exposed until the OEM migrates its SDK. - **Devices named:** Proximus BBOX 3 and BBOX3V+, VOO Netgear CG3100/CG3700 and Technicolor TC7210/CGA4233, Orange Belgium ASKEY TCG3000. The proof of concept on the TCG3000 pulls the Wi-Fi key and sends it over the air. - **Response so far:** Proximus switched WPS off across its fleet within 24 hours of the report, Orange Belgium is evaluating the same, Telenet turned out not to be affected. No CVE means no scanner, no CVSS score and no line in anyone's vulnerability management report. - The researcher notes that AI tooling cut the work from months to under a week. The attack surface did not change. The cost of finding bugs in it did. ## What this means for the business An operator buys CPE by the hundred thousand, on a tender that measures Wi-Fi coverage, throughput and price. The box that wins has a radio chip from one supplier, a Wi-Fi SDK from that same supplier, and firmware from an ODM that nobody at the operator has ever audited. When the defect sits in the SDK, the operator cannot fix it, often cannot even get a CVE to point at, and the only lever left is to disable a feature on a million homes overnight. The number to put next to the saved euros per unit is the cost of a fleet-wide emergency change and the headlines that follow. Since August 1, 2025 the EU Radio Equipment Directive makes cybersecurity a condition for selling such devices, and the Cyber Resilience Act takes over in December 2027. The regulator will ask what you tested. "It passed TR-398" will not be the answer they want. ## What this means for engineers - **TR-398 measures performance.** Issue 4, in force since September 2026, covers RF capability, coverage, multiple stations, stability and mesh. There is no security robustness chapter. A gateway can score top marks and fall over on one malformed EAP frame. - **Fuzz the stacks that listen before authentication.** WPS, EAPOL, 802.11 management and action frames, DHCP, TR-069 and the web UI all parse attacker-controlled input. Protocol fuzzers exist for this; Defensics alone ships 6 WLAN suites covering 802.11, WPA2 and WPA3 handshakes. If your supplier cannot show fuzzing results for the exact SDK build, assume nobody ran them. - **Test the mitigation, not the checkbox.** Disable WPS, reboot, factory reset, upgrade firmware, then prove with a sniffer that the gateway no longer answers WPS probes. Settings that silently come back are a known failure mode on CPE. - **Put robustness into acceptance** on a real-radio testbed: traffic at full load on all bands while a fuzzer hammers the management plane. Crashes under load look different from crashes on an idle box. - **Ask for the SDK version** in the bill of materials and keep it in the contract. Forever-day chips are a procurement decision, made years before the bug is public. ## What to do Add one line to your CPE acceptance program: robustness of every protocol the gateway parses before a client is authenticated, run under traffic load, with results you can show a regulator. TEST4NET will help you build that scenario into your test plan and run it on the gateway you are about to buy. Test. Compare. Decide. ## Sources - [Quentin Kaiser: One parser, two bugs (WPSplinter), October 16, 2026](https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/) - [The Register: Broadcom Wi-Fi bug turns sweet 16, still lets strangers hijack your router (October 19, 2026)](https://www.theregister.com/networks/2026/10/19/broadcom-wi-fi-bug-turns-sweet-16-still-lets-strangers-hijack-your-router/5303771) - [Broadband Forum TR-398 Issue 4: Wi-Fi Residential and SOHO Performance Testing](https://www.broadband-forum.org/technical-library/?number=TR-398) - [Black Duck: WLAN fuzzing with Defensics](https://www.blackduck.com/blog/wlan-fuzzing-defensics.html) Share Pass it on to someone who runs a network Independent lab data is most useful in the hands of the people who make the call. Send this piece to a colleague. [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ftest4net.com%2Fblog%2Fwpsplinter-broadcom-wps-bug-cpe-acceptance-needs-protocol-fuzzing) [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Ftest4net.com%2Fblog%2Fwpsplinter-broadcom-wps-bug-cpe-acceptance-needs-protocol-fuzzing&text=A+16-year-old+bug+in+Broadcom+WPS+still+opens+1.5+million+gateways.+Throughput+tests+never+saw+it) [Telegram](https://t.me/share/url?url=https%3A%2F%2Ftest4net.com%2Fblog%2Fwpsplinter-broadcom-wps-bug-cpe-acceptance-needs-protocol-fuzzing&text=A+16-year-old+bug+in+Broadcom+WPS+still+opens+1.5+million+gateways.+Throughput+tests+never+saw+it) [WhatsApp](https://wa.me/?text=A+16-year-old+bug+in+Broadcom+WPS+still+opens+1.5+million+gateways.+Throughput+tests+never+saw+it%20https%3A%2F%2Ftest4net.com%2Fblog%2Fwpsplinter-broadcom-wps-bug-cpe-acceptance-needs-protocol-fuzzing) Copy link More apps ![](https://test4net.com/hubfs/IMG_0070.jpg) Written by ### [Alexander Zemskov](https://test4net.com/blog/author/az) Alexander Zemskov leads network and security testing at TEST4NET, an independent, vendor-neutral testing lab in Yerevan, Armenia. With 19+ years in performance and load testing on IXIA, Spirent, Keysight, Xena and Xinertel platforms, he runs NGFW, WAF, IPS, DLP and SASE evaluations for telecom operators, banks and system integrators. [LinkedIn](https://www.linkedin.com/in/azemskov/) [Website](https://test4net.com/?hsLang=en) [Previous article 390 operators sell 5G, 98 run a 5G core. The bottleneck is not the radio](https://test4net.com/blog/gsa-5g-sa-98-of-390-operators-test-the-5g-core-before-launch?hsLang=en) In this article On the bench ### Have a device to put through this? Send us the shortlist and the KPIs that decide it. We will come back with a scoped test plan, a timeline and a fixed price. [Talk to a test engineer](https://test4net.com/contacts?hsLang=en) Industry News ## Keep reading [![390 operators sell 5G, 98 run a 5G core. The bottleneck is not the radio](https://test4net.com/hs-fs/hubfs/blog-covers/gsa-5g-sa-98-of-390-operators-test-the-5g-core-before-launch.png?width=880&height=550&name=gsa-5g-sa-98-of-390-operators-test-the-5g-core-before-launch.png)](https://test4net.com/blog/gsa-5g-sa-98-of-390-operators-test-the-5g-core-before-launch?hsLang=en) [News](https://test4net.com/news?hsLang=en) ### [390 operators sell 5G, 98 run a 5G core. The bottleneck is not the radio](https://test4net.com/blog/gsa-5g-sa-98-of-390-operators-test-the-5g-core-before-launch?hsLang=en) Light Reading summarized the GSA numbers on October 23, 2026: more than 390 operators have launched commercial 5G, and 98 of them have launched 5G Standalone. Seven years… ![](https://test4net.com/hs-fs/hubfs/IMG_0070.jpg?width=22&height=22&name=IMG_0070.jpg) Alexander Zemskov Oct 30, 2026 · 4 min read [![How we measure power under load: watts per Gbps at 4 load steps](https://test4net.com/hs-fs/hubfs/blog-covers/how-we-measure-power-under-load.png?width=880&height=550&name=how-we-measure-power-under-load.png)](https://test4net.com/blog/how-we-measure-power-under-load?hsLang=en) [Standards and methodology](https://test4net.com/blog/tag/standards-and-methodology) ### [How we measure power under load: watts per Gbps at 4 load steps](https://test4net.com/blog/how-we-measure-power-under-load?hsLang=en) The datasheet of a switch, router or firewall gives two power figures: "typical" and "maximum". Neither says at what load, with which optics or at what inlet temperature.… ![](https://test4net.com/hs-fs/hubfs/IMG_0070.jpg?width=22&height=22&name=IMG_0070.jpg) Alexander Zemskov Oct 30, 2026 · 5 min read [![How we test remote-access VPN: 9:00 logins, MFA and failover](https://test4net.com/hs-fs/hubfs/blog-covers/how-we-test-remote-access-vpn.png?width=880&height=550&name=how-we-test-remote-access-vpn.png)](https://test4net.com/blog/how-we-test-remote-access-vpn?hsLang=en) [Security](https://test4net.com/blog/tag/security-performance) ### [How we test remote-access VPN: 9:00 logins, MFA and failover](https://test4net.com/blog/how-we-test-remote-access-vpn?hsLang=en) A VPN concentrator datasheet gives a user count and a throughput figure, both taken separately: thousands of idle tunnels for the first, a few fat ones for the second. A … ![](https://test4net.com/hs-fs/hubfs/IMG_0070.jpg?width=22&height=22&name=IMG_0070.jpg) Alexander Zemskov Oct 30, 2026 · 5 min read [![TEST4NET LLC](https://test4net.com/hubfs/test4net-logo-fixed.svg)](https://test4net.com?hsLang=en) Independent testing and validation for telecom, information security and cloud infrastructure – real insights, not assumptions [mailto:sales@test4net.com](mailto:sales@test4net.com) #### Navigate - [Home](https://test4net.com/?hsLang=en) - [Why TEST4NET](https://test4net.com/why-test4net?hsLang=en) - [About us](https://test4net.com/about?hsLang=en) - [Contact](https://test4net.com/contacts?hsLang=en) - [Blog](https://test4net.com/blog?hsLang=en) - [Industry News](https://test4net.com/news?hsLang=en) #### Get in touch Sales [sales@test4net.com](mailto:sales@test4net.com) Support [support.test4net.com](https://support.test4net.com) © 2026 TEST4NET LLC. All rights reserved. [Privacy Policy](https://test4net.com/privacy-policy?hsLang=en) [Legal](https://test4net.com/legal?hsLang=en) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Alexander Zemskov", "url" : "https://test4net.com/blog/author/az" }, "dateModified" : "2026-10-30T09:00:02.183Z", "datePublished" : "2026-10-30T09:00:00.000Z", "headline" : "A 16-year-old bug in Broadcom WPS still opens 1.5 million gateways. Throughput tests never saw it", "image" : [ "https://test4net.com/hubfs/blog-covers/wpsplinter-broadcom-wps-bug-cpe-acceptance-needs-protocol-fuzzing.png" ], "mainEntityOfPage" : { "@id" : "https://test4net.com/blog/wpsplinter-broadcom-wps-bug-cpe-acceptance-needs-protocol-fuzzing", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://test4net.com/hubfs/test4net-logo-fixed.svg" }, "name" : "TEST4NET LLC" } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://test4net.com/#organization", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "AM", "addressLocality" : "Yerevan", "postalCode" : "0033", "streetAddress" : "3 Hakob Hakobyan Street (Mergelyan Hub)" }, "alternateName" : "TEST4NET", "contactPoint" : { "@type" : "ContactPoint", "availableLanguage" : [ "en", "ru", "hy" ], "contactType" : "sales", "email" : "sales@test4net.com", "telephone" : "+374-60-88-88-99" }, "description" : "Independent, vendor-neutral lab for testing network and cybersecurity products — NGFW, WAF, IPS, DLP and SASE — and an authorized distributor of test, measurement and network infrastructure solutions.", "email" : "sales@test4net.com", "foundingDate" : "2024", "image" : "https://test4net.com/hubfs/og-t4n.png", "logo" : "https://test4net.com/hubfs/test4net-logo-fixed-2.svg", "name" : "TEST4NET LLC", "sameAs" : [ "https://www.linkedin.com/company/test4net/", "https://t.me/TEST4NET", "https://www.facebook.com/people/Test4net-LLC/61591470856077/" ], "telephone" : "+374-60-88-88-99", "url" : "https://test4net.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://test4net.com/#website", "@type" : "WebSite", "inLanguage" : "en", "name" : "TEST4NET", "potentialAction" : { "@type" : "SearchAction", "query-input" : "required name=search_term_string", "target" : { "@type" : "EntryPoint", "urlTemplate" : "https://test4net.com/hs-search-results?term={search_term_string}" } }, "publisher" : { "@id" : "https://test4net.com/#organization" }, "url" : "https://test4net.com/" } ``` ```json { "@context" : "https://schema.org", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://test4net.com/", "name" : "TEST4NET", "position" : 1 }, { "@type" : "ListItem", "item" : "https://test4net.com/blog", "name" : "Blog", "position" : 2 }, { "@type" : "ListItem", "item" : "https://test4net.com/blog/wpsplinter-broadcom-wps-bug-cpe-acceptance-needs-protocol-fuzzing", "name" : "A 16-year-old bug in Broadcom WPS still opens 1.5 million gateways. Throughput tests never saw it", "position" : 3 } ] } ```