WPSplinter
Broadcom WPS EAP fragment reassembly vulnerability
Broadcom’s legacy WPS Monitor implementation does not correctly constrain reassembled EAP-WPS fragments to the size of its destination buffer. A nearby attacker can reach the parser over Wi-Fi without knowing the network key or completing WPS enrollment. On vulnerable devices, this can cause controlled memory disclosure and arbitrary code execution.
This page documents research presented by Quentin Kaiser at Hexacon 2026. Broadcom declined to assign a CVE identifier. The name “WPSplinter” is a researcher-assigned name, not a CVE.
Affected devices
The list below is not exhaustive. The vulnerability is in a shared Broadcom Wi-Fi software component, so other products using the affected WPS Monitor implementation may also be affected. Firmware and hardware revisions can differ within a model.
| Vendor | Product | Versions / notes | Known deployment |
|---|---|---|---|
| ARRIS | SURFboard AC1200 | All listed versions | — |
| Arcadyan | VRV9517 | At least through v6.00.18 | KPN (“Experia Box V10A”), SPARK |
| Askey | TCG3000 | Confirmed | Orange Belgium, VOO |
| Askey | RTF3505VW | At least through 203_n43 | Movistar / Telefónica |
| CastleNET | NetMASTER Infinity 401MP, CBW-383ZN, CBW-383Z4, CBW-700V | Confirmed | Türksat Cablenet |
| Cisco | RV110W, RV130W, RV215W, RV340W, WAP121, WAP125, WAP150, WAP361, WAP371, WAP571, WAP571E, WAP581 | Confirmed | — |
| Comtrend | VG8050 | Confirmed; firmware builds observed through 2025 | Movistar / O2 / Telefónica |
| Huawei | B310, B315, B593, WS880 | Listed; verify firmware | — |
| NetComm | NF4V, NF10W, NF10WV, NF8AC, NF17ACV, NF18ACV, NF18MESH | Confirmed | Multiple Australian ISPs |
| Netgear | CG3100, CG3700B | Confirmed | Orange Belgium, VOO |
| Neuf | NB6, NB6VAC | Reported; firmware assessment ongoing | SFR |
| Nokia | G-140W-H, G-240W series, G-2426G-A | Confirmed; firmware varies | Multiple operators worldwide |
| Sagemcom | F@ST 3864 / 3864OP, F@ST 4353, F@ST 5336 | Confirmed | Optus, Belong, Proximus |
| Technicolor | TC7210, CGA4233 | Observed in deployed VOO fleet | VOO |
| Tenda | D301, N300 | Reported; verify firmware | — |
| TP-Link | VR1600, TD-VG5612, Archer C3150, C5400, VR600, VR900, VR2800 | Confirmed | Australian ISPs, Türk Telekom |
| ZTE | F680 v4, 368N | Confirmed | Multiple operators worldwide |
| Zyxel | VMG3312-B10A, VMG3312-B10B | Confirmed | Türk Telekom |
| MitraStar | GPT-2541GNAC | At least through 100VNJ0b38 | Movistar / Telefónica |
For a current, community-maintained list and device reporting instructions, see the repository’s affected-device list.
Frequently asked questions
- Does an attacker need the Wi-Fi password?
- No. The vulnerable parser is reachable over Wi-Fi before normal WPS enrollment completes. The attacker must be within radio range.
- What is the impact?
- Research demonstrated controlled memory disclosure and arbitrary code execution on affected devices. The exact privileges and consequences depend on the product and firmware.
- Does disabling WPS in the settings fix the problem?
- Do not assume so. A settings toggle may not remove or fully disable the vulnerable parser. Ask the device vendor or ISP whether a firmware update addresses this specific issue.
- Which Broadcom platforms are in scope?
- The research covers Broadcom’s legacy WPS Monitor stack on eCos and Linux. Identified SoC families include BCM3380, BCM3383, BCM33834, BCM3390, BCM63xx, BCM65xx, and BCM68xx. A chipset match alone does not establish that a particular firmware is vulnerable.
- Is there a patch?
- Broadcom stated that it replaced WPS Monitor with hostapd starting in 2018. Device owners need a firmware update from their OEM or ISP; older eCos-based products may have no migration path.
- Why is there no CVE number?
- Broadcom declined to request a CVE, stating that the affected software was obsolete and outside its support window. “WPSplinter” is an informal researcher-assigned name.
- Is every device in the list confirmed vulnerable?
- Evidence and firmware coverage vary by model. The list records devices identified by the research; it is not a guarantee that every hardware or firmware revision is affected. The list is also incomplete.
- How can an organization check its devices?
- Use the YARA rules to triage extracted firmware or the repository’s fingerprinting script to identify the legacy Broadcom implementation over the air. These are detection aids; confirm results against the exact firmware.
References
- One Parser, Two Bugs, Many Routers — technical research and disclosure timeline.
- Hexacon 2026 slides — “Exploiting Broadcom WiFi Across eCos and Linux.”
- Broadcom WPS detection toolkit — YARA rules, fingerprinting script, and device list.
- Detection and reporting instructions.