Broadcom Wi-Fi bug turns sweet 16, still lets strangers hijack your router - The Register

Chip giant knew about the flaw in 2018, researcher claims, but millions of devices may still be vulnerable

A 16-year-old security flaw in Broadcom's Wi-Fi software could let attackers hijack millions of routers without knowing the network password, even though the chipmaker reportedly knew about the problem since 2018. Security researcher Quentin Kaiser disclosed the vulnerability, dubbed "WPSplinter," revealing two bugs in Broadcom's proprietary Wi-Fi implementation that date back to at least 2010. An attempted fix arrived eight years later, but Kaiser claims it didn't fully resolve the problem. The bugs lie in Broadcom's handling of Wi-Fi Protected Setup (WPS), the feature that lets users connect devices to a wireless network without manually entering a password. Kaiser found that specially crafted WPS messages could corrupt the router's memory, allowing someone within Wi-Fi range to run their own code on the device. They wouldn't need the Wi-Fi password, and the router's owner wouldn't have to do a thing.