Researcher discloses unpatched Broadcom Wi-Fi flaw allowing root code execution on routers

Past-week coverage · Original source published 2026-10-19.

Security researcher Quentin Kaiser disclosed on October 16 an unpatched flaw in Broadcom's Wi-Fi setup software that, he said, lets an attacker within radio range run code as root on Broadcom-based routers. According to the disclosure, the attack needs neither the network password nor any pairing step.

Kaiser demonstrated the technique against home gateways supplied by three Belgian internet providers. In one of those cases, he showed the Wi-Fi password being read off the device.

The claim matters because of where the bug sits. A router's Wi-Fi setup component is reachable over the air by anyone nearby, so a flaw there can be attempted before a device is joined to a network or trusted by a user. Root access on a gateway would put an attacker above the device's own protections rather than inside a single client.

The disclosure, as reported, does not establish a fix. No patch status, affected version range or severity score was given, and it is not clear which Broadcom-based models beyond the demonstrated gateways are exposed.

For defenders, the practical questions are inventory and exposure. Knowing which gateways on your network use Broadcom Wi-Fi silicon, and how far their radio signal reaches beyond the premises, is the starting point. Where a vendor issues guidance or firmware, treat it as the authoritative source rather than assuming a fix exists.