16-Year-Old Broadcom Wi-Fi Flaw Leaves Router Fleets Exposed

A vulnerability in legacy Broadcom Wi-Fi software may allow an attacker within wireless range to execute commands or extract information from vulnerable routers without knowing the network password.

Security researcher Quentin Kaiser traced the issue to Wi-Fi Protected Setup parsing code that dates to at least 2010. Testing demonstrated code execution against routers supplied by major Belgian internet providers. Kaiser estimated that approximately 1.56 million devices may be affected in Belgium alone, with related software used across products from multiple manufacturers.

The exposure is unusual because it lacks a CVE identifier. Broadcom reportedly acknowledged the underlying issue but declined to assign one because the affected software was considered obsolete. The absence of a CVE can make the problem harder for vulnerability scanners, procurement systems and patch-management teams to track.

Some manufacturers have patches available, but devices running unsupported firmware may need to be replaced. The risk depends on the router model and installed firmware, so the presence of a Broadcom component does not by itself confirm exposure.

"This is not the first case of software being classified as obsolete but still deployed in millions of devices, and it will not be the last," said Seemant Sehgal, founder and CEO of BreachLock.

Internet providers and enterprise network teams should identify affected hardware, obtain current firmware from the device manufacturer and replace equipment that no longer receives security support. Changing the Wi-Fi password alone would not address a flaw that can be reached before normal authentication.

The research underscores a persistent network-security problem: unsupported embedded software can remain operational for years after its original vendor considers it retired.