Broadcom WPS Fragment Reassembly Flaw Enables Root Code Execution on Millions of Routers

The flaw sits in Broadcom's WPS implementation handling fragmented EAPOL messages. An attacker within radio range sends crafted fragments that corrupt heap memory, enabling arbitrary read and code execution. Kaiser demonstrated live exploits extracting PSK from an Askey TCG3000 and spawning a reverse shell over Wi-Fi frames on a Sagemcom BBOX3V+ without any credentials or association. Evidence includes YARA signatures matching vulnerable firmware binaries back to 2010 builds and a live detection script confirming exposure on three Belgian ISPs. Broadcom acknowledged the issue internally since 2018 yet shipped only an incomplete fix and directed customers to hostapd, leaving eCos-based chips unpatchable. CERT/CC closed the case without assignment because Broadcom controls CVE issuance. WPS has carried similar memory issues since its inception; this case shows how vendor reluctance to publish identifiers sustains exposure across consumer gateways. Older chipsets now constitute permanent attack surface while newer Linux variants depend on OEMs migrating code. The pattern matches prior Broadcom Wi-Fi lapses where procurement records reveal continued shipping of affected silicon. No mitigation exists beyond firmware replacement. Affected operators must audit inventories with Kaiser's tools; regulators should mandate CVE registration for chipset flaws to break the disclosure deadlock.