Someone sits in a car outside your client’s office. They don’t have the Wi-Fi password. They don’t need it.

On October 16, security researcher Quentin Kaiser disclosed a flaw in the Wi-Fi setup software on Broadcom-based routers. An attacker within radio range runs code as root on the router. No network password. No pairing step.

He showed it working on home gateways from 3 Belgian internet providers. On one, the exploit read the Wi-Fi password off the router and joined the network with it. On another, it opened a remote shell over the air.

Kaiser reports no real-world attacks yet. The working exploits are his own. But if your clients run their office internet on the box the ISP supplied, this one is yours to deal with.

What’s broken, and why there’s no fix

The flaw sits in Broadcom’s version of Wi-Fi Protected Setup (WPS), the feature that lets a device join Wi-Fi without typing a password. The Hacker News reports that Broadcom’s code mishandles fragmented setup messages, so a nearby attacker sends crafted ones that corrupt the router’s memory.

Kaiser traces the code back to at least 2010. Broadcom shipped an incomplete fix in 2018, then told customers to switch to a different Wi-Fi software package instead. He says no fix has been deployed to the affected routers.

There’s no CVE either. Broadcom holds the authority to assign CVEs for its own products and would not register one. The Hacker News found no CVE as of October 19.

A CVE is the identifier defenders use to track a flaw. Without one, there’s nothing for your vulnerability reports to match against.

Now the part that should worry you. The affected chips fall into 2 families. The newer Linux-based models, the BCM3390, BCM65xx and BCM68xx, are fixable if their makers switch Wi-Fi software. The older eCos-based models, the BCM3380, BCM3383 and BCM33834, have no usable fix. Kaiser calls it a forever-day: a flaw that will never be patched on those devices.

Broadcom’s WPS code is embedded in routers and access points from dozens of vendors, and Kaiser estimates millions of devices worldwide are affected. He points to no setting that blocks the attack over the air.

There’s no agent for an ISP router

Your endpoint tooling stops at the laptop. You don’t own the ISP router. You don’t control its firmware. You have nowhere to install an agent.

The same goes for printers, cameras, door controllers and every other box that runs its own software. These are the devices that don’t run agents, and they are exactly where a forever-day lives.

What you do have is network behavior. Every device on a network talks. A router that has been taken over starts talking differently, and so does a network with an uninvited guest on it.

You watch the traffic, not the box.

The 3 signals worth watching

New devices. In one of Kaiser’s demos, the exploit read the Wi-Fi password and then joined the network with it. A device that wasn’t there yesterday, on an office network that rarely changes, is the first thing to flag.

Unexpected outbound sessions. A router or other unmanaged box opening connections to places it has never talked to before needs a look. Don’t rely on this signal alone. In the second demo, the remote shell ran over Wi-Fi frames, so no outside server was involved.

Guest Wi-Fi reaching business systems. Guest networks exist to keep visitors away from file shares, finance systems and servers. If traffic from the guest side touches any of them, either the segmentation has failed or someone has found a way across.

What to do this week

1. List every ISP-supplied router and access point at each client office.

2. Check them. Kaiser has published YARA rules for extracted firmware and a script that listens to a live access point and reports whether it looks vulnerable. Treat a hit as a reason to check further, not a confirmed finding.

3. Ask each ISP which chipset its router uses and whether a replacement is available.

4. Keep guest Wi-Fi on its own segment, away from business systems.

5. Watch the network behavior of everything you don’t manage, using firewall and network data alongside your endpoint tools.

6. Replace the forever-day hardware. For gear that will never be fixed, replacement is the practical option.

Steps 1 to 4 are admin work. Replacement takes longer because it runs through the ISP. Watching is the only step that never finishes.

The outcome: unmanaged kit gets watched

Do this and the box in the corner stops being a blind spot. You know what is on each client network, and you see the moment something new joins it.

You also know which hardware is on borrowed time, so the replacement conversation with the client happens before an incident rather than after.

My advice would be to start with clients in shared buildings and on busy streets, where someone in Wi-Fi range is ordinary. Kaiser says the attack works at a distance, not only up close.

This is the gap whole-network visibility closes. At enhanced.io, our SOC watches network behavior across client environments, including the devices that will never run an agent, and detects and escalates what looks wrong to your team.

Key takeaways

• A Broadcom WPS flaw lets anyone in Wi-Fi range run code as root on affected routers, with no password.

• There is no CVE, no fix has reached the affected routers and older eCos-based chips will never be patched.

• There is no setting that blocks the attack over the air, and no way to put an agent on an ISP router.

• Watch network behavior: new devices, unexpected outbound sessions and guest Wi-Fi reaching business systems.

• Replace forever-day hardware where you find it, starting with clients in shared buildings and busy streets.

  
  

About enhanced.io

enhanced.io is a channel-only Open XDR SOCaaS built exclusively for MSPs, with 400+ integrations across endpoint, network, cloud, identity and IoT/OT. We work only through MSP partners and never sell direct to end clients. To talk about how enhanced.io fits your stack, book a partnership conversation with Hannah Lloyd.