October 21, 2026, 11:15 am | Read time: 3 minutes
A security flaw in Broadcom’s Wi-Fi software, known for 16 years, could endanger millions of routers worldwide. The vulnerability, called “WPSplinter,” allows malicious code to be executed on affected devices under certain conditions. Many routers currently lack security updates. Users should urgently check their devices.
The vulnerability affects Broadcom’s implementation of Wi-Fi Protected Setup (WPS), a technique for simplifying device connections to a Wi-Fi network. According to security researcher Quentin Kaiser, specially crafted WPS messages can trigger memory errors, enabling the execution of foreign code. The router owner does not need to take any action for this to occur.
Numerous Routers Affected
Kaiser successfully demonstrated the attacks in his investigations against several routers. Devices from Belgian providers Proximus and Orange, as well as models from Netgear, Technicolor, and Askey, were affected. Estimates suggest that more than 1.5 million devices in Belgium alone could be impacted. The global number of vulnerable routers remains unclear.
According to the researcher, attackers can read information from the router’s memory in this way. In tests, he managed to extract stored Wi-Fi passwords and subsequently gain access to the respective network. Users might not notice such access.
Well-known manufacturer calls for the disposal of certain routers
Security Flaw in Bluetooth Headphones: Sony, Bose, JBL and Other Brands Affected
Known for Years, but Unpatched in Many Places
The age of the problem is particularly noteworthy. The underlying flaw is said to have existed since 2010. Broadcom released a partial fix in 2018 and later recommended manufacturers switch to the open-source solution hostapd. However, not all providers have apparently taken this step.
The security researcher confidentially reported the vulnerability to Broadcom in July 2026, granting the usual 90-day period for resolution. Broadcom pointed to existing patches and recommended contacting the respective device manufacturers. Inquiries with providers and the security organization CERT/CC initially led to no significant results.
By mid-October 2026, none of the routers examined by Kaiser were fully secured, according to his findings. There is no evidence of attacks having occurred yet. However, the researcher warns that this could change at any time.
Also of interest: These Fritzboxes should no longer be used
Users Should Check Firmware
Kaiser recommends affected users first identify the exact model of their router and update the installed firmware to the latest version. Users should then inquire with the manufacturer or provider whether their device is affected by the vulnerability.
For older routers that no longer receive updates, a replacement might be advisable. Simply disabling the WPS function may not be sufficient, according to the researcher. The attack does not necessarily require a fully completed WPS connection process and could still be possible despite the function being disabled.