Security researcher Quentin Kaiser disclosed a vulnerability in Broadcom's Wi-Fi setup software that allows attackers within radio range to execute code as root on affected Broadcom-based routers. The flaw was demonstrated against home gateways from three Belgian internet providers, with one instance resulting in the Wi-Fi password being read from the device. As of the disclosure date, no patch is available.

Which products are affected?

Broadcom Wi-Fi setup software, Broadcom-based routers

What should defenders do?

Users of affected Broadcom-based routers should monitor official Broadcom security advisories for patch availability. Until a patch is released, it is recommended to segment the affected devices on a separate network, disable unnecessary remote management features, and ensure physical security of the router where possible. Avoid deploying these devices in high-security environments until a fix is available.

highvulnerability

Unpatched Broadcom Wi-Fi Flaw Allows Remote Code Execution on Routers

Researcher discloses vulnerability exploitable within radio range on Broadcom-based home gateways

Cyber.TechVoidPublished about 2 hours agoUpdated less than a minute ago1 min read

Unpatched Broadcom Wi-Fi Flaw Allows Remote Code Execution on Routers

Key Takeaways

A vulnerability in Broadcom's Wi-Fi setup software allows code execution as root within radio range of affected routers.
The attack does not require the network password or pairing, and was demonstrated against Belgian ISP-supplied home gateways.
One demonstration resulted in the disclosure of the device's Wi-Fi password.

Related Security News

criticalcyber attacks

Active Exploitation of OS Command Injection in SiteGuard Server Edition WAF

Reports indicate that an OS command injection vulnerability in SiteGuard Server Edition's WAF component is being actively exploited in the wild. Successful exploitation allows attackers to execute commands with the highest privileges on the server, affecting both Linux (root) and Windows (SYSTEM) environments.

BleepingComputerabout 18 hours ago1 min read

criticalCVE

Drupal patches critical RCE flaws, warns of imminent exploitation

Drupal has released security updates addressing two critical remote code execution vulnerabilities. The vendor warns that active exploitation may emerge soon, urging administrators to apply patches immediately.

BleepingComputer1 day ago1 min read

Unpatched Broadcom Wi-Fi Flaw Allows Remote Code Execution on Routers

Key Takeaways

Related Security News

Active Exploitation of OS Command Injection in SiteGuard Server Edition WAF

Drupal patches critical RCE flaws, warns of imminent exploitation

Quick answers

Security Details

Sources

CISA Issues Urgent Warning for Actively Exploited Ivanti Zero-Day Flaw

Six Critical Vulnerabilities Discovered in J4Care dcm4chee-arc-light Medical Imaging Platform

Researchers Chain 37-Year-Old Integer Overflow and Kernel Flaw to Escalate Privileges on OpenBSD 7.9

CISA Adds Actively Exploited Authentication Bypass Flaw in BeyondTrust Remote Support to KEV Catalog