WPSplinter
Broadcom WPS EAP fragment reassembly vulnerability
Broadcom’s legacy WPS Monitor implementation does not correctly constrain reassembled EAP-WPS fragments to the size of its destination buffer. A nearby attacker can reach the parser over Wi-Fi without knowing the network key or completing WPS enrollment. On vulnerable devices, this can cause controlled memory disclosure and arbitrary code execution.
This page documents research presented by Quentin Kaiser at Hexacon 2026. Broadcom declined to assign a CVE identifier. The name “WPSplinter” is a researcher-assigned name, not a CVE.
Affected devices
The list below is not exhaustive. The vulnerability is in a shared Broadcom Wi-Fi software component, so other products using the affected WPS Monitor implementation may also be affected. Firmware and hardware revisions can differ within a model.
| Vendor | Product | Versions | Confirmed | ISPs |
|---|---|---|---|---|
| Actiontec | C1000A | CAC004-31.30L.95 | Y | CenturyLink |
| Actiontec | C1900A | CAB005-31.30L.96 | Y | CenturyLink |
| Actiontec | C2000A | CAH006-31.30L.95 | Y | CenturyLink |
| Actiontec | C2300A | CAS001-31.165L.11 | Y | CenturyLink |
| Actiontec | C3000A | CAD004-31.165L.13 | Y | CenturyLink |
| Actiontec | F2250 | 36.128L.05 36.128L.09 | Y | Frontier |
| Actiontec | Q1000 | QAQ004-31.20L.7 | Y | CenturyLink |
| Actiontec | T3200 | ? | Y | ? |
| Adtran | C424G | CAO001-4.16.011.2 | Y | CenturyLink |
| ARRIS | ARRIS SURFboard AC1200 | ALL | Y | - |
| ARRIS | BGW210-700 | 1.0.24 1.0.29 1.10.9 1.5.11 1.5.12 1.6.7 1.8.18 1.9.14 1.9.16 2.10.4 2.10.6 2.11.5 2.12.4 2.15.4 2.16.4 2.17.4 2.17.5 2.3.4 2.4.4 2.5.6 2.6.4 2.7.1 2.7.7 2.8.5 2.8.7 2.9.4 | Y | AT&T |
| Arcadyan | VRV9517 | at least up to v6.00.18 | Y | SPARK |
| ARRIS | NVG589 | 11.5.0h0d51 11.6.0h0d48 9.2.2h0d79 CFEROM | Y | AT&T |
| ARRIS | NVG599 | 11.5.0h0d51 11.6.0h0d48 9.2.2h0d79 CFEROM 9.2.2h0d83 | Y | AT&T |
| ARRIS/CommScope | X5001 (PX5001 firmware target, XF3) | 3.12p10s1 3.12p3s2 3.12p8s1 3.12p9s1 3.14p4s1 3.14p5s1 3.14p6s1 3.14p7s2 3.14p8s1 3.5p8s1 3.6p1s3 3.6p2s1 3.6p3s1 3.6p3s2 3.6p4s1 3.6p5s1 4.0p1s1 4.0p1s3 4.0p3s1 4.0p4s2 4.0p4s3 4.0p5s1 4.0p6s1 4.10p7s1 4.10p8s2 4.12p10s3 4.12p13s1 4.12p14s6 4.12p22s1 4.12p24s1 4.12p3s3 4.12p4s2 4.12p7s1 4.12p8s1 4.2p1s2 4.2p1s3 4.2p3s5 4.2p6s1 4.2p6s3 4.2p7s1 4.2p8s1 4.2p9s1 4.4p2s1 4.4p4s2 4.4p7s1 4.4p8s1 4.6p4s1 4.6p5s4 4.6p7s1 4.8p10s1 4.8p11s2 4.8p12s1 4.8p7s1 4.8p9s2 | Y | Comcast (Xfinity) |
| Askey | RTF3505VW REV4_B6M (Movistar Spain, GPON HGU) | ES_s00.00_g003_R3505VWSTD203_n43 | Y | Movistar Spain / Telefónica |
| Askey | RTV1900VW | 08.06.06 | Y | Swisscom (Internet-Box light) |
| Askey | Speedport W 723V Typ A | 1.01.022 ALL | Y | Deutsche Telekom |
| Askey | Speedport W 723V Typ A (RTV1645VW-E83 OEM) | 1.00.092 | Y | Deutsche Telekom |
| Askey | TCG3000 | ALL | Y | Orange Belgium, VOO |
| Askey | RTF3505VW | ALL | Y | Movistar / O2 / Telefonica |
| ASUS | DSL-AC3100 | 1.10.04_Build460 1.10.05_Build502 1.10.05_Build503 1.10.06_Build585 1.10.06_Build591 1.10.08_Build593 | Y | - |
| ASUS | DSL-AC68U | 3.0.0.4.382_50302 3.0.0.4.384_21128 3.0.0.4.384_56087 3.0.0.4.384_80766 3.0.0.4.384_81140 3.0.0.4.384_81727 3.0.0.4.384_81981 3.0.0.4.386_38287 3.0.0.4.386_38832 3.0.0.4.386_39648 3.0.0.4.386_41995 3.0.0.4.386_43252 3.0.0.4.386_45662 3.0.0.4.386_47534 3.0.0.4.386_50117 3.0.0.4.386_50120 3.0.0.4.386_52006 | Y | - |
| ASUS | DSL-AC68VG | 5.00.04_build248 5.00.07_build271 5.00.08_build272 5.00.09_build274 | Y | - |
| ASUS | DSL-AC87VG Annex B | 1.00.13_build502 1.00.14_build508 1.05.16_build287 1.05.17_build299 1.05.18_build305 1.05.19_build307 | Y | - |
| ASUS | DSL-AC88U (Annex A/B) | 1.10.04_build460 1.10.05-Build502 1.10.05_Build503 1.10.06_Build585 1.10.08_Build593 | Y | - |
| ASUS | DSL-AC88U Annex A | 1.10.06_Build591 1.10.08_Build593 | Y | - |
| ASUS | DSL-AC88U Annex B | 1.10.06_Build591 1.10.08_Build593 | Y | - |
| ASUS | DSL-AX82U | 3.0.0.4.386.49608 3.0.0.4.386_42438 3.0.0.4.386_43563 3.0.0.4.386_43600 3.0.0.4.386_48378 3.0.0.4.388_22048 3.0.0.4.388_23756 3.0.0.4.388_24894 3.0.0.4.388_24906 3.0.0.4.388_24919 3.0.0.4.388_25052 3.0.0.4.388_25110 | Y | - |
| ASUS | DSL-N12HP | 1.0.0.16 1.0.0.8 | Y | - |
| CastleNET | NetMASTER Infinity 401MP | ALL | Y | Türksat Cablenet |
| CastleNET | NetMASTER CBW-383ZN | ALL | Y | Türksat Cablenet |
| CastleNET | NetMASTER CBW-383Z4 | ALL | Y | Türksat Cablenet |
| CastleNET | NetMASTER CBW-700V | ALL | Y | Türksat Cablenet |
| Cisco | RV110W | ALL | Y | - |
| Cisco | RV130W | ALL | Y | - |
| Cisco | RV215W | ALL | Y | - |
| Cisco | RV340W | ALL | Y | - |
| Cisco | WAP121 | ALL | Y | - |
| Cisco | WAP125 | ALL | Y | - |
| Cisco | WAP150 | ALL | Y | - |
| Cisco | WAP361 | ALL | Y | - |
| Cisco | WAP371 | ALL | Y | - |
| Cisco | WAP571 | ALL | Y | - |
| Cisco | WAP571E | ALL | Y | - |
| Cisco | WAP581 | ALL | Y | - |
| Comtrend | VG8050 | ALL | Y | Movistar / O2 / Telefonica |
| Comtrend | VR-3031eu | RA41-412VDC-C11_R04 | Y | Vodafone |
| D-Link | DSL-2600U H/W Rev C4 | 1.0.1 1.0.3 1.0.4 1.0.5 | Y | - |
| D-Link | DSL-2640B Rev E1 | reve1_206_ALL_multi_20130122 | Y | - |
| D-Link | DSL-2640U | NRU_C4_1.0.10_20110407 | Y | - |
| D-Link | DSL-2640U Annex B | 1.0.1 1.0.2 | Y | - |
| D-Link | DSL-2640U H/W Rev C4 | 1.0.14 1.0.19 1.0.20 1.0.24 1.0.30 1.0.32 | Y | - |
| D-Link | DSL-2640U/B1A/T3A | 1.0.3 1.0.7 | Y | - |
| D-Link | DSL-2641B Rev E1 | reve1_100b04_04142011_ALL_multi_20110414 reve1_201_03092012_ALL_multi_20120309 reve1_206_ALL_multi_20121204 | Y | - |
| D-Link | DSL-2650U H/W Rev C1 | 1.0.13 1.0.16 1.0.17 | Y | - |
| D-Link | DSL-2650U H/W Rev T1 | 1.0.3 | Y | - |
| D-Link | DSL-2730B REVT | DSL-2730B-T1-FW-AU_1.00 DSL-2730B-T1-FW-AU_2.00 DSL-2730B_T1_FW_AU_2.01 | Y | - |
| D-Link | DSL-2730U Rev C1 (ME) | 1.00_B03 | Y | - |
| D-Link | DSL-2740B | 1.00 2.06 | Y | - |
| D-Link | DSL-2740B Rev F1 | revf1_206_ALL_multi_20121126 | Y | - |
| D-Link | DSL-2740B Rev F1 (AU) | 1.00 2.00 2.01 2.03 2.04 2.07 | Y | - |
| D-Link | DSL-2740BR REVF | DSL2740B_F1_AU_1.00_IPv6 DSL2740B_F1_AU_2.00_10132011 DSL2740B_F1_AU_2.01_03082012 DSL2740B_F1_AU_2.03_06282012 DSL2740B_F1_AU_2.04_07262012 DSL2740B_F1_AU_2.07_10082012 | Y | - |
| D-Link | DSL-2740U H/W Rev C5 | 1.0.11 1.0.13 | Y | - |
| D-Link | DSL-2740U H/W Rev T1 | 1.0.3 1.0.5 | Y | - |
| D-Link | DSL-2741B Rev F1 | revf1_100b09_04142011_ALL_multi_20110414 revf1_201_03092012_ALL_multi_20120309 revf1_206_ALL_multi_20121228 | Y | - |
| D-Link | DSL-2750B Rev D | revd_eu104-1601_ALL_multi_20150722 revd_eu105-1521_EU_multi_20180730 | Y | - |
| D-Link | DSL-2750B Rev D1 | revd1_EU102_ALL_multi_20130610 revd1_EU102_ALL_multi_20131111 revd1_eu104-08032015_ALL_multi_20150803 | Y | - |
| D-Link | DSL-2750B REVB | DSL2750B_B1_AU_1.00_06232011 DSL2750B_B1_AU_2.00_12282011 DSL2750B_B1_AU_2.01_03012012 DSL2750B_B1_AU_2.03_06282012 DSL2750B_B1_AU_2.05_08032012 DSL2750B_B1_AU_2.07_10082012 | Y | - |
| D-Link | DSL-2750B REVD1 | revd1_eu102-09232014_ALL_multi_20140923 | Y | - |
| D-Link | DSL-2750B REVT | DSl-2750B.T1_Firmware_AU_3.00_20121018 DSl-2750B.T1_Firmware_AU_3.01_20130313 DSl-2750B.T1_Firmware_AU_3.02_20131211 DSl-2750B.T1_Firmware_AU_3.05_20140718 DSL-2750B.T1_Firmware_AU_3.06_20141028 DSL-2750B.T1_Firmware_AU_3.08_25032015 | Y | - |
| D-Link | DSL-2750U H/W Rev C | 1.0.11 | Y | - |
| D-Link | DSL-2750U H/W Rev C + B1A/T2A shared 1.0.4 package | 1.0.4 | Y | - |
| D-Link | DSL-2751 Rev D1 | revd1_EU100_ALL_multi_20130424 revd1_EU101-11102014_ALL_multi_20141110 revd1_EU101_ALL_multi_20131008 | Y | - |
| D-Link | DSL-2790U (Middle East; HW not stated) | DSL-2790U-ME_v1.00 | Y | - |
| D-Link | DSL-2790U Rev A | AU 1.00.14 20151211 R1767 | Y | - |
| D-Link | DSL-2870B REVA | DSL-2870B_FW_upgrade_from_v1.01.24_to_v2.00.00AU_06062013 DSL-2870B_FW_v1.01.14_07272012 DSL-2870B_FW_v1.01.23_11062012 DSL-2870B_FW_v1.01.24_11152012 | Y | - |
| D-Link | DSL-2880AL Rev A (Australia) | AU 1.00 08202013 | Y | - |
| D-Link | DSL-2880AL REVA | DSL-2880AL_A1_AU_1.01_01072014 DSL-2880AL_A1_AU_1.01b_03132014 DSL-2880AL_A1_AU_2.00_06052014 DSL-2880AL_A1_AU_2.01_09112014 | Y | - |
| D-Link | DSL-2890AL Rev A (AU) | AU 1.01.02 20130524 AU 1.01.03 20130613 AU 1.01.04 20130906 AU 1.02.02 20131203 AU 1.02.04 20140121 AU 1.02.06 20140528 AU 1.02.07 20150427 AU 1.02.08 20150507 AU 1.02.10 20160617 | Y | - |
| D-Link | DSL-2890AL Rev A1 (Middle East listing) | 1.02.08 | Y | - |
| D-Link | DSL-2900AL Rev A (AU) | AU 1.00.25 20160329 AU 1.00.26 20160426 AU 1.01.00 20160905 | Y | - |
| D-Link | DSL-3580L Rev A2 | reva2_eu202-08042015_ALL_multi_20150804 | Y | - |
| D-Link | DSL-3580L REVA2 | reva2_eu201-12192014-1013_ALL_multi_20141219 | Y | - |
| D-Link | DSL-3590L Rev A | reva_eu10012_ALL_multi_20160704 | Y | - |
| D-Link | DSL-4320L A1 | AU 1.00.14 20151214 AU 1.00.15 20160107 AU 1.00.16 20160121 AU 1.00.19 20160306 AU 1.00.20 20160421 AU 1.00.21 20160524 AU 1.01.00 20160928 AU 1.01.02 20161109 AU 1.01.05 20170116 AU 1.01.11 | Y | - |
| D-Link | DSL-4320L REVA | DSL4320L_AU_1.01.11 | Y | - |
| D-Link | DSL-5300 Rev A | AU 1.00 AU 1.05 AU 1.07 | Y | - |
| D-Link | DSL-6740U | 1.0.10 | Y | - |
| D-Link | DSL-G225 H/W Rev U1 | 2.5.9 | Y | - |
| D-Link | DSL-G225 Rev J (AU) | AU 1.0.2 AU 1.0.3 AU 1.0.4 AU 1.0.5 AU 1.0.6 | Y | - |
| D-Link | DSL-G225 REVJ | VDM206-2-DL-DSL-G225-EE-NoF-U1-R435-20170313.w | Y | - |
| FiberHome | HG6245D | RP2725 | Y | PLDT, Globe (Philippines) |
| Huawei | B310 | ALL | - | - |
| Huawei | B315 | ALL | - | - |
| Huawei | B593 | ALL | - | - |
| Huawei | HG659 VER.B | V100R001C206B020 V100R001C206B026 | Y | One NZ (formerly Vodafone NZ) |
| Huawei | HG659-13 (Vodacom South Africa) | V100R001C195B021 | Y | Vodacom |
| Huawei | HG8245D | V300R017C10SPC126 | Y | - |
| Huawei | HG8245H | V300R013C10SPC122 | Y | - |
| Huawei | HG8245Q | V300R017C10SPC115 | Y | - |
| Huawei | HG8247H | V300R019C10SPC11B110 | Y | - |
| Huawei | Speedport Hybrid | 050124.04.00.013 ALL | Y | Deutsche Telekom |
| Huawei | Speedport W 724V Typ A | 05011603.06.003 ALL | Y | Deutsche Telekom |
| Huawei | WS880 | ALL | - | - |
| MitraStar | GPT-2541GNAC | ALL | Y | Movistar / O2 / Telefonica |
| Motorola | MD1600 | 1.0.0.6-72 | Y | ? |
| NetComm | NF4V | ALL | Y | Exetel, Harbour ISP, Spintel |
| NetComm | NF10W | ALL | Y | Exetel, Aussie Broadband, Harbour ISP |
| NetComm | NF10WV | ALL | Y | Exetel, Aussie Broadband |
| NetComm | NF8AC | ALL | Y | Activ8me, Mate, SkyMesh, Aussie Broadband |
| NetComm | NF17ACV | ALL | Y | SkyMesh, Aussie Broadband |
| NetComm | NF18ACV | ALL | Y | Aussie Broadband, Tangerine, Mate, Spintel |
| NetComm | NF18MESH | ALL | Y | Aussie Broadband |
| NetComm | NL19MESH | NC.UR-R6B022.EN_ALG | Y | ? |
| NetComm | NL1901ACV | NC.AU-R6B033.EN | Y | ? |
| Netgear | CG3100 | ALL | Y | Orange Belgium, VOO |
| Netgear | CG3700B | ALL | Y | Orange Belgium, VOO |
| Netgear | D6200 | 1.1.00.09 1.1.00.14 1.1.00.17 1.1.00.24 1.1.00.36 1.1.00.38 1.1.00.40 | Y | - |
| Netgear | D6220 | 1.0.0.16 1.0.0.28 1.0.0.32 1.0.0.60 1.0.0.72 1.0.0.74 1.0.0.76 1.0.0.80 | Y | - |
| Netgear | D6300 | 1.0.0.16 | Y | - |
| Netgear | D6300 (All regions except NA and Germany) | 1.0.0.16 1.0.0.72 | Y | - |
| Netgear | D6300 (All regions except NA) | 1.0.0.24 | Y | - |
| Netgear | D6300 (Worldwide except NA and Germany) | 1.0.0.102 1.0.0.90 | Y | - |
| Netgear | D6400 | 1.0.0.102 1.0.0.106 1.0.0.108 1.0.0.114 1.0.0.34 1.0.0.52 1.0.0.88 | Y | - |
| Netgear | D7000 | 1.0.0.18 | Y | - |
| Netgear | D7000 v1 | 1.0.1.84 | Y | - |
| Netgear | D8500 | 1.0.3.52 | Y | - |
| Netgear | DGN2200Bv3 (Germany) | 1.1.00.23 | Y | - |
| Netgear | DGN2200Bv3 (Germany/Annex B) | 1.1.00.24 | Y | - |
| Netgear | DGN2200Bv4 (Germany) | 1.0.0.109 1.0.0.60 | Y | - |
| Netgear | DGN2200v3 (North America) | 1.1.00.21 1.1.00.23 1.1.00.24 | Y | - |
| Netgear | DGN2200v3 (Worldwide except NA and Germany) | 1.1.00.23 1.1.00.24 | Y | - |
| Netgear | DGN2200v3 (WW excluding NA/Germany) | 1.1.00.24 | Y | - |
| Netgear | DGN2200v4 (All regions except Germany) | 1.0.0.114 1.0.0.116 1.0.0.118 1.0.0.126 1.0.0.132 1.0.0.24 1.0.0.46 1.0.0.58 1.0.0.76 | Y | - |
| Netgear | DGN2200v4 (initial release) | 1.0.0.5 | Y | - |
| Netgear | DGND3700v2 (North America) | 1.1.00.08 1.1.00.17 1.1.00.21 1.1.00.26 | Y | - |
| Netgear | DGND3700v2 (Worldwide) | 1.1.00.26 | Y | - |
| Netgear | DGND3700v2 (WW) | 1.1.00.12 1.1.00.22 1.1.00.24 1.1.00.26 | Y | - |
| Netgear | DGND4000 | 1.1.00.15 | Y | - |
| Netgear | DGND4000 (North America) | 1.1.00.10 | Y | - |
| Netgear | DGND4000 (WW) | 1.1.00.15 | Y | - |
| Netgear | WNR3500L | 1.2.2.48 | Y | K-Net |
| Neuf | NB6 | TODO | Y | SFR |
| Neuf | NB6VAC | 4.0.44d 4.0.44f 4.0.44i 4.0.44j 4.0.44k 4.0.45 4.0.45c 4.0.45d 4.0.46 TODO | Y | RED by SFR SFR |
| Nokia | BGW320-505 | 3.17.5 dnvpnP 021 | Y | AT&T |
| Nokia | G-140W-H | 3FE48077HJIL96_V6 | Y | - |
| Nokia | G-140W-H, G-240W-B, G-240W-A, G-240W-C, G-240W-F, G-240W-G, G-240W-J | ? | Y | Telmex, Speedy, ETB, Axtel, lucascell, STC, Du Telecom, Kazakhtelecom, Türk Telecom, Wind, Viettel, Etisalat, GO Telecom, True Internet, Singtel, Vodafone Turkey, Lattelekom, Sky Telecom, Vivacom, Proximus, Orange Ivory Coast, Canalbox Caraibes, Inea |
| Nokia | G-240W-C | 3FE46322IJHL28_V3 | Y | - |
| Nokia | G-240W-G | 3FE47550HJIL96_V9 | Y | - |
| Sagemcom | F@ST 2504 / 2504N | 6.14.2a4 | Y | Sky |
| Sagemcom | F@st 2704 (Etisalat) | 6.29.3a4N | Y | - |
| Sagemcom | F@st 2704 V2 (TPSA/Orange Polska) | 5.38.6a4N | Y | Orange Polska |
| Sagemcom | F@st 2804 v7 HW 2704 (Rostelecom) | 6.54zhy4a4N_RTC | Y | Rostelecom |
| Sagemcom | F@ST 3804 | 7.120a4N_RTC | Y | ? |
| Sagemcom | F@ST 3864 / 3864OP | ALL | Y | Optus |
| Sagemcom | F@ST 4353 | ALL | Y | Belong |
| Sagemcom | F@st 5336 | ALL | Y | Proximus |
| Sagemcom | F@st 5350 GV | SG790131200068 (3.12.35) SG790131200312 (3.12.5301) SG790131200412 (3.12.5901) | Y | GVT |
| Sagemcom | F@st 5360 Sunrise | SG4D10001448 (8c.46.118.3_5.1bp10) | Y | Sunrise |
| Sagemcom | F@st 5364 (TalkTalk) | SG4K10001E00t / 6.72.38 SG4K10002600t / 6.72.40 SG4K10002808t / 6.72.44 SG4K10002810t / 6.72.44.11 SG4K10002816t / 6.72.44.14 | Y | TalkTalk |
| Sagemcom | F@st 5650 GVT (GPON) | 8.126.1.28 | Y | GVT |
| Sagemcom | F@ST 5655 V2 | - | LIKELY | Magyar Telekom |
| Sagemcom | F@ST 5656 | - | LIKELY | Orange Polska, NJU |
| Sagemcom | F@ST 5657 | - | LIKELY | Yoigo |
| Sagemcom | F@ST5317GV GVT | 6.51.31 | Y | - |
| Sagemcom | F@ST5317GV Vivo | 6.51.28 | Y | - |
| Sagemcom | F@ST5350GV GVT | 3.12.5904 | Y | - |
| Sercomm | Easybox 804 | up to 05.02_5_4_8_1_325_1_21_1_8 at least | Y | Vodafone (DE) |
| SerComm | EasyBox 804 (CIS804) | 01.05_5.4.8.1.242.1.24 02.06_5.4.8.1.270.1.29 03.02_5.4.8.1.299.1.28 | Y | Vodafone Germany |
| Sercomm | Group ONT L3 (253794565) | V1 | LIKELY | Vodafone / Lowi |
| Sercomm | Speedport W 724V Typ C | ? | LIKELY | Deutsche Telekom |
| Sercomm | RT-GM6 | ALL | LIKELY | Rostelecom |
| SFR | NB6VAC | 4.0.44d 4.0.44f 4.0.44i 4.0.44j 4.0.44k 4.0.45 4.0.45c 4.0.45d 4.0.46 | Y | RED by SFR |
| Sky | SR203 | at least 1.3.8.0.878-2020w47.2 | Y | Sky |
| Sky | SkyHub SR101 | 3.4.5 | Y | Sky |
| Sky | SkyHub SR102 | 2.8.8 | Y | Sky |
| SmartRG | SR320n | 2.6.2.4 ICE | Y | - |
| SmartRG | SR505n | 2.6.2.6 | Y | - |
| SmartRG | SR616ac | 1.0.0.140.ICE | Y | - |
| SmartRG | SR630n | 1.0.0.12.ICE | Y | Kölbi / ICE (Costa Rica) |
| Technicolor | C2000T | CTH005-4.12.1.44 | Y | CenturyLink |
| Technicolor | C2100T | CTQ003-4.12.1.78 | Y | CenturyLink |
| Tenda | D151 V2.0 (US) | V50.21.1.5 | Y | - |
| Tenda | D301 / N300 | - | - | - |
| Tenda | D301 V1.0 (US) | 1.2.11.2 | Y | - |
| Tenda | V1200 | 53.0.0.4 | Y | - |
| Tenda | V1200 V1.0 | V53.0.0.4 | Y | - |
| Tenda | V1200 V1.0 (US) | V53.0.0.4 | Y | - |
| Tenda | V300 | 53.0.1.6 | Y | - |
| Tenda | V300 v1.0 | V53.0.1.6 | Y | - |
| Tenda | W150D V3 (Annex B) | US v1.0.0.2 | Y | - |
| TP-Link | Archer C3150 | ALL | Y | Türk Telekom |
| TP-Link | Archer C3150 V2 | Archer C3150(US)_V2_160812 Archer C3150(US)_V2_170225 Archer C3150(US)_V2_170628 Archer C3150(US)_V2_170926 Archer C3150_V2_170411 | Y | - |
| TP-Link | Archer C5400 | ALL | Y | Türk Telekom |
| TP-Link | Archer D5 V2 | Archer D5(EU)_V2_160229 Archer D5(EU)_V2_160517 Archer D5_V2_150731 | Y | - |
| TP-Link | Archer D9 V1 | 0.9.1 0.1 v0041.0 Build 160115 Rel.60441n Archer D9_V1_140905 Archer D9_V1_141027 Archer D9_V1_150313 Archer D9_V1_150514 | Y | - |
| TP-Link | Archer D9 v1 | 0.9.1_0.1 Build 150826 | Y | - |
| TP-Link | Archer D9 V1 (EG) | Archer_D9_V1_150617_EG (2015-06-17) | Y | - |
| TP-Link | Archer D9 V1 (EU) | Archer_D9(EU)_V1_160224 Archer_D9(EU)_V1_160303 | Y | - |
| TP-Link | Archer VR1600v V1 | Archer VR1600v(AU)_V1_2.1.0 Build 260318 | Y | - |
| TP-Link | Archer VR1600v V2 | Archer VR1600v(ANZWISP)_V2_0.1.0 Build 260317 Rel.7757n | Y | - |
| TP-Link | Archer VR2800 | ALL | Y | Türk Telekom |
| TP-Link | Archer VR2800 V1 | (EU) 170809 (EU) 201103 Archer VR2800(EU)_V1_170110 Archer VR2800(EU)_V1_200227 Archer VR2800(EU)_V1_210313 Archer VR2800(EU)_V1_220120 Archer VR2800(EU)_V1_220512 Archer_VR2800(EU)_V1_170809 Archer_VR2800(EU)_V1_220512 Archer_VR2800(EU)V1_200624 beta Archer_VR2800(EU)V1_200708 beta Archer_VR2800(EU)V1_201103 beta Archer_VR2800V1_0.8.0_0.9.1_up_boot(220120) ArcherVR2800(EU)_V1_200710 | Y | - |
| TP-Link | Archer VR400 V1 | 160613 Archer VR400(EU)_V1_160613 Archer_VR400(EU)_V1_170302 | Y | - |
| TP-Link | Archer VR400 V2 | (EU) 201104 200227 201104 220126 Archer VR400(EU)_V2_170224 Archer VR400(EU)_V2_170719 Archer VR400(EU)_V2_220126 ArcherVR400(EU)_V2_200227 ArcherVR400(EU)_V2_200706 ArcherVR400(EU)_V2_201104 | Y | - |
| TP-Link | Archer VR600 | ALL | Y | Türk Telekom |
| TP-Link | Archer VR600 V1 | 160217 160614 Archer VR600(EU)_V1_160217 Archer VR600(EU)_V1_160520 Archer VR600(EU)_V1_160614 Archer VR600(EU)_V1_170308 Archer_VR600AU_v1_BETA | Y | - |
| TP-Link | Archer VR600 V2 | (AU) 200624 170504 200226 Archer VR600(EU)_V2_170504 Archer VR600(EU)_V2_200226 Archer_VR600(AU)_V2_170302 Archer_VR600(AU)_V2_190123 Archer_VR600(AU)_V2_200226 Archer_VR600(EU)V2_200701 beta Archer_VR600(EU)V2_201104 beta Archer_VR600_AU2.0 beta (2018-02-06) Archer_VR600V2_210409 beta | Y | - |
| TP-Link | Archer VR600v V2 | (EU) 170814 (EU) 200624 Archer VR600v(EU)_V2_220112 | Y | - |
| TP-Link | Archer VR900 | ALL | Y | Türk Telekom |
| TP-Link | Archer VR900 V1 | 160218 160316 170119 Archer VR900(EU)_V1_160218 Archer VR900(EU)_V1_160316 Archer VR900(EU)_V1_170119 Archer VR900_V1_150429 Archer VR900_V1_150729 Archer_VR900_V1_150909 Archer_VR900_V1_151111 Archer_VR900_V1_151210 | Y | - |
| TP-Link | Archer VR900 V2 | 160721 Archer VR900(EU)_V2_160721 | Y | - |
| TP-Link | Archer VR900 V3 | 170303 200228 210322 Archer VR900(EU)_V3_170303 Archer VR900(EU)_V3_200228 Archer VR900(EU)V3_191218 beta ArcherVR900(EU)_V3_210322 | Y | - |
| TP-Link | Deco X20-DSL V1 | Deco X20-DSL(EU)_V1_1.0.11 Build 20230609 Deco X20-DSL(EU)_V1_1.0.12 Build 20230714 Deco X20-DSL(EU)_V1_1.0.13 Build 20231226 Deco X20-DSL(EU)_V1_1.0.2_20210317 Deco X20-DSL(EU)_V1_1.0.3_20210422 Deco X20-DSL(EU)_V1_1.0.4_Build_20210807 Deco X20-DSL(EU)_V1_1.0.5 Build 20221214 Deco X20-DSL(EU)_V1_1.0.6 Build 20230303 Deco X20-DSL(US)_V1_1.0.12 Build 20230714 | Y | - |
| TP-Link | TD-VG5612 | ALL | Y | MyNetFone, Barefoot, OntheNet |
| TP-Link | TD-W8950N V1 | 1.0.2_150916R36150 TD-W8950N_V1_140106 TD-W8950N_V1_150205 TD-W8950N_V1_160203 | Y | Orange Polska |
| TP-Link | TD-W8950N V1 (Orange Polska) | 1.0.2 Build 150916 Rel.36150 | Y | Orange Polska |
| TP-Link | TD-W8950ND V2 | TD-W8950ND_V2_130503 TD-W8950ND_V2_131031 | Y | - |
| TP-Link | TD-W8960N V5 | TD-W8960N(IT)_V5_151228 TD-W8960N(PL)_V5_160729 TD-W8960N_V5_130924 TD-W8960N_V5_131129 TD-W8960N_V5_140317_IT TD-W8960N_V5_140804 TD-W8960N_V5_140815 TD-W8960N_V5_141107 | Y | - |
| TP-Link | TD-W8960N V6 | TD-W8960N(PL)_V6_160426 TD-W8960N(PL)_V6_160721 TD-W8960N(TR)_V6_160407 TD-W8960N_V6_150228 TD-W8960N_V6_150522 TD-W8960N_V6_150619_TR TD-W8960N_V6_150716_PL TD-W8960N_V6_151019 | Y | - |
| TP-Link | TD-W8968 V3 | TD-W8968(IT)_V3_160108 TD-W8968_V3_140321 TD-W8968_V3_140326_IT TD-W8968_V3_140821 TD-W8968_V3_150205 TD-W8968_V3_150512 | Y | - |
| TP-Link | TD-W8968 V4 | TD-W8968(EU)_V4_151130 TD-W8968(EU)_V4_151229 TD-W8968_V4_150504 | Y | - |
| TP-Link | TD-W8968 V5 | TD-W8968(EU)_V5_160905 TD-W8968(EU)_V5_170331 | Y | - |
| TP-Link | TD-W8968 V5 (RU) | TD-W8968(RU)_V5_170119 | Y | - |
| TP-Link | TD-W8968 V5 (UN) | TD-W8968v5_un_2_0_0_190307 | Y | - |
| TP-Link | TD-W8970 V3 | TD-W8970_V3_141212 TD-W8970_V3_150427 | Y | - |
| TP-Link | TD-W8970 V3 (EU) | TD-W8970(EU)_V3_160816 | Y | - |
| TP-Link | TD-W8970 V3 (UN) | TD-W8970_V3_141010 | Y | - |
| TP-Link | TD-W9970 V1 | 160812 161111 170726 TD-W9970(CA) Bell-certified firmware TD-W9970(EU)_V1_160413 TD-W9970(EU)_V1_160705 TD-W9970(EU)_V1_160812 TD-W9970(EU)_V1_161111 TD-W9970(EU)_V1_170726 TD-W9970(TR)_V1_160316 TD-W9970_V1_150616 TD-W9970_V1_150831 | Y | - |
| TP-Link | TD-W9970 V2 | 160912 170919 200228 TD-W9970(EU)_V2_170919 TD-W9970(EU)_V2_200228 TD-W9970(TR)_V2_160928 | Y | - |
| TP-Link | TD-W9970 V2 (EU) | TD-W9970(EU)_V2_160912 | Y | - |
| TP-Link | TD-W9970 V3 | (EU) 200227 190419 200227 221012 TD-W9970(EU)_V3.0_190419 TD-W9970(EU)_V3_200227 TD-W9970_V3_221012_RC | Y | - |
| TP-Link | TD-W9970 V3.0 | (EU) 190419 TD-W9970(EU)_V3.0_190419 | Y | - |
| TP-Link | TD-W9970B V1 (EU Annex B) | TD-W9970B(EU)_V1_160413 | Y | - |
| TP-Link | TD-W9977 V1 (EU) | TD-W9977(EU)_V1_161123 | Y | - |
| TP-Link | VR1600 | ALL | Y | OntheNet, Future Broadband, Internode |
| ZTE | F680 v4 | ALL | Y | MasMovil, ThailandToT, Telkom, Linkstar, Mnc, Viettel, VNPT, SeteTec, EgyptTEData, Ais, MTN, FranceReunicable, RTC, Indosat, MAXCom, EKT, OSP, Moldtelecom, Türk Telekom, TurkNet, AtlantisNet |
| ZTE | 368N | ALL | Y | KPN (device is called "Experia Box v9"), Türk Telekom |
| ZTE | H168N | V1.1.0_GR4T10 | Y | Hellas On Line (HOL) |
| ZTE | H168N (HOL) | V1.1.0_GR4T10 | Y | - |
| ZTE | Speedport Entry 2i | OTET11LW4O6P5A | Y | Cosmote |
| ZTE | Speedport Entry 2i (Annex A) | OTET11LW4O6P5A OTET12LW4O6P5A | Y | Cosmote |
| ZTE | Speedport Entry 2i (Cosmote) | OTET12LW4O6P5A | Y | - |
| ZTE | ZXHN F660 | V5.2.10P2T29 | Y | VNPT |
| ZTE | ZXHN H168N | V1.1.0_GR4T11 | Y | Hellas On Line (HOL) |
| ZTE | ZXHN H168N (HOL variant) | V1.1.0_GR4T11 | Y | - |
| ZTE | ZXHN H168N V1.1.0 | V1.1.0_GR4T10 V1.1.0_GR4T11 | Y | HOL |
| ZTE | ZXHN H268A V1.0 | V1.0.1_ETL.1T7 | Y | Exetel |
| ZTE | ZXHN H268N HV100 | FV100_OTET11LW4O6P5A FV100_OTET12LW4O6P5A | Y | Cosmote |
| Zyxel | 6641 | ? | Y | O2 Czech Republic |
| Zyxel | AX7501-B1 | V5.17(ABPC.8)C0 | Y | Init7 |
| Zyxel | C1100Z | CZW006-4.16.012.0 | Y | CenturyLink |
| Zyxel | C2100Z | CZQ002-4.16.011.30 | Y | CenturyLink |
| Zyxel | C3000Z | CZD003-4.16.009.47 CZD005-4.16.011.0 | Y | CenturyLink |
| Zyxel | Q1000Z | QZZ002-4.4.015.4 | Y | CenturyLink |
| Zyxel | VMG3312-B10A, VMG3312-B10B | ALL | Y | Türk Telekom |
| Zyxel | VMG8924-B30A | ? | Y | O2 Czech Republic |
| Zyxel | VMG1312-B30B | ? | Y | O2 Czech Republic |
| Zyxel | VMG3925-B10C | V5.13(AAVF.18)C0 | Y | AAISP |
| Zyxel | XMG3927-Bx0A WiFi | V513ABQO1b5_D0 | Y | green.ch |
For a current, community-maintained list and device reporting instructions, see the repository’s affected-device list.
Frequently asked questions
- Does an attacker need the Wi-Fi password?
- No. The vulnerable parser is reachable over Wi-Fi before normal WPS enrollment completes. The attacker must be within radio range.
- What is the impact?
- Research demonstrated controlled memory disclosure and arbitrary code execution on affected devices. The exact privileges and consequences depend on the product and firmware.
- Does disabling WPS in the settings fix the problem?
- Do not assume so. A settings toggle may not remove or fully disable the vulnerable parser. Ask the device vendor or ISP whether a firmware update addresses this specific issue.
- Which Broadcom platforms are in scope?
- The research covers Broadcom’s legacy WPS Monitor stack on eCos and Linux. Identified SoC families include BCM3380, BCM3383, BCM33834, BCM3390, BCM63xx, BCM65xx, and BCM68xx. A chipset match alone does not establish that a particular firmware is vulnerable.
- Is there a patch?
- Broadcom stated that it replaced WPS Monitor with hostapd starting in 2018. Device owners need a firmware update from their OEM or ISP; older eCos-based products may have no migration path.
- Why is there no CVE number?
- Broadcom declined to request a CVE, stating that the affected software was obsolete and outside its support window. “WPSplinter” is an informal researcher-assigned name.
- Is every device in the list confirmed vulnerable?
- Evidence and firmware coverage vary by model. The list records devices identified by the research; it is not a guarantee that every hardware or firmware revision is affected. The list is also incomplete.
- How can an organization check its devices?
- Use the YARA rules to triage extracted firmware or the repository’s fingerprinting script to identify the legacy Broadcom implementation over the air. These are detection aids; confirm results against the exact firmware.
References
- One Parser, Two Bugs, Many Routers — technical research and disclosure timeline.
- Hexacon 2026 slides — “Exploiting Broadcom WiFi Across eCos and Linux.”
- Broadcom WPS detection toolkit — YARA rules, fingerprinting script, and device list.
- Detection and reporting instructions.