Unauthenticated WiFi RCE in Broadcom 802.11 WPS EAP parser (Broadcom-based routers)
Public disclosure at Hexacon on 2026-10-16 with working exploit demos; Broadcom declined a CVE and devices remained unpatched as of Oct 15, 2026, so defenders must act now.
A researcher disclosed a WPS EAP reassembly overflow in Broadcom's proprietary 802.11 implementation, present since ~2010 with only an incomplete 2018 patch. It can be triggered remotely over WiFi without the network key or WPS enrollment, yielding controlled information disclosure and arbitrary code execution; the researcher demonstrated exploitation on several ISP CPE (Proximus BBOX3V+, Netgear CG3100/CG3700, Technicolor TC7210/CGA4233, ASKEY TCG3000), with video demos extracting the PSK and getting a root reverse shell over 802.11. There is no CVE (Broadcom declined to assign one) and no vendor advisory; affected device counts and the full OEM list are not fully established.
Affected: Broadcom eCos platforms BCM3380/BCM3383/BCM33834 (forever-day) and Linux platforms BCM3390/BCM65xx/BCM68xx running Broadcom's proprietary 802.11/WPS stack
How to Test
Use the researcher's fingerprinting script and YARA rule to detect the vulnerable Broadcom 802.11/WPS stack; confirm whether your access point/CPE uses an affected chipset (BCM3380/3383/33834 on eCos, or BCM3390/65xx/68xx on Linux) running Broadcom's proprietary WPS rather than hostapd.
How to Mitigate
No complete vendor fix for eCos platforms — treat as a forever-day and replace or decommission affected devices; disable WPS to reduce reachability; for Linux-based platforms request firmware that migrates to hostapd from the OEM; restrict physical RF exposure where devices cannot be replaced.