WPSplinter in Broadcom routers: how to work safely on a network you cannot check

A Wi-Fi password is usually seen as the lock on a network: anyone without it stays out. You carry that assumption into a hotel room, a holiday rental or a client’s office. In each case, you connect to a router that someone else installed and maintains. Research published this month shows that, on many routers with Broadcom chips, someone within Wi-Fi range can take control of the router without knowing the password. That is a reason to change the assumption: rather than trust the local network, protect your traffic before it reaches it.

What was discovered

The vulnerability. Researcher Quentin Kaiser published his findings on 16 October 2026 about a vulnerability called WPSplinter. It affects Broadcom’s implementation of WPS, the feature that lets you connect a device to a wireless network at the press of a button, without typing a password. According to the researcher, the vulnerable code has been in Broadcom’s software development kit since at least 2010. It can be triggered remotely over Wi-Fi, without the network key or a completed WPS pairing. The vulnerability allows an attacker to extract information from the router’s memory and run code on it—in other words, take control of it. In one published demonstration, the researcher extracted the Wi-Fi password from an Orange Belgium router and used it to join the network. On a Proximus router, he opened a remote control channel over Wi-Fi itself. He says the attack also works from a considerable distance.

The scale. According to the researcher, the issue affects dozens of manufacturers, hundreds of products and millions of access points worldwide—the devices that provide Wi-Fi. On older chips running the eCos operating system (BCM3380, BCM3383, BCM33834), he describes it as a forever day: a vulnerability for which no fix is expected. On Linux-based chips, such as BCM3390, BCM65xx and BCM68xx, a fix is possible only if the device manufacturer switches to a different software component.

Why there is no fix. According to the researcher, Broadcom released a partial fix in 2018 without a public announcement and advised manufacturers to move to a new version of its software development kit. He says the company refused to assign the vulnerability a CVE number, the public identifier that vendors and network administrators use to track vulnerabilities. He believes this is why many manufacturers did not fix it. As of 15 October, none of the vulnerable devices he identified had received an update.

Belgium as a case study. The researcher demonstrated the vulnerability on routers from three of Belgium’s four largest internet providers. He estimates that hundreds of thousands of routers at each provider are affected. He rated his confidence in that estimate as medium. In an update dated 20 October, he wrote that Proximus had remotely disabled WPS on all its routers as an interim measure and would complete the update in the coming weeks. He also wrote that Orange Belgium was considering a similar step and that the fourth provider, Telenet, was not affected. Some coverage said Telenet might be affected; the researcher’s update makes clear that it is not. He stresses that the issue is not limited to Belgium.

An official warning. Thailand’s cybersecurity emergency response team, ThaiCERT, issued an advisory stating that the main risk is targeted exploitation from within Wi-Fi range, including on public networks and in hotels. This is because routers receive little attention in network security monitoring. The advisory recommends identifying device models, watching for firmware updates—the software built into the router—from the manufacturer or provider, and considering replacing devices from product lines that cannot be fixed.

The broader list. According to The Hacker News, a broader list published by the researcher includes Cisco small-business access points and routers from Huawei and ARRIS, among others. However, the list contains both models confirmed to be vulnerable and models marked only as “likely vulnerable” by an automated check. According to the same report, the researcher did not report any real-world attacks; the demonstrations are his own.

What this means for you

The password no longer determines who gets in. Most advice on securing a home network begins and ends with a strong password. This vulnerability bypasses the need for a password entirely: someone within Wi-Fi range does not need to guess anything. In the researcher’s demonstration, the password itself was stolen.

The fix is not in your hands. The router your internet provider installed usually belongs to the provider, and its firmware is updated only when the provider decides to do so. A fix for the vulnerable code has to pass through the chip manufacturer, the router manufacturer and the provider before it reaches your home. In this case, according to the researcher, the bug has existed for 16 years, and the partial fix from 2018 did not reach the vulnerable devices he identified. Without a CVE number, it is also harder for you or your IT specialist to ask a simple question: “Has my device been updated to address this vulnerability?”

Most networks you use are not yours. In a hotel, a rental property, a shared office or a client’s premises, you have no way to know which chip is in the router or when it was last updated. The researcher himself notes that vulnerabilities like this are particularly suited to attacks by a “nearby neighbour” and to breaking into hotel networks. ThaiCERT also points to these scenarios. The practical assumption, then, is that any local network may be compromised, including your home network.

What someone who controls the router can do. All your traffic passes through the router. According to the researcher, control of the router allows an attacker to collect and alter that traffic. Whoever controls it can read anything passing through without encryption and see which websites devices contact. They can also change DNS responses—the service that translates a website name into a numerical address—to redirect you to a fake website. With the password they obtained and their position on the network, they can also try to reach other devices in the home or office, such as cameras, printers and computers.

Protection needs to start on the device. It is worth encrypting traffic on the device, before it passes through the router. When the device sends all traffic, including DNS queries, through an encrypted tunnel to a server you trust, people on the local network cannot read the content passing through it. The router itself needs separate attention: update it and, if necessary, replace it. The two steps complement each other.

Probably not the last time. The researcher writes that the work would have taken months, but advanced AI models helped him finish it in less than a week. In our view, this means older code in routers and household devices will be examined faster than before, and more findings will be published. That is not a reason to panic. It is a reason to adopt habits that do not depend on every router along the way being up to date.

What about Israel? The researcher notes that the affected manufacturers also serve markets outside Belgium. It is better to check than to assume.

What to do now

• Identify your router. The model is usually printed on a label underneath the device. Check whether it appears on the device list linked from the researcher’s post. According to The Hacker News, some models on the list were marked only as “likely vulnerable”.
• Ask your provider directly. Is my router affected by the Broadcom chip vulnerability published in October 2026 (WPSplinter)? When will a firmware update be available? Have you remotely disabled WPS as an interim measure, as Proximus did?
• Replace equipment that is no longer supported. If your router uses one of the eCos chips on the list, or your provider will not commit to an update, ask for a replacement or consider switching to a supported router.
• Disable WPS if you do not use it, but only as an additional step. According to The Hacker News, the researcher did not identify a setting that blocks the attack. Updating or replacing the router therefore remains the main course of action.
• Change the Wi-Fi password after updating or replacing the router, because the demonstration showed that it can be extracted from the router.
• Encrypt on every network, including at home. Use a VPN regularly on your phone and computer. In a hotel, a rental property or a client’s premises, connect to it before doing anything else. You can check that the connection is active on the What is my IP address page.
• Enable two-step verification on important accounts, so that an exposed password alone is not enough.
• For businesses: make an inventory of all routers and access points in the office, including small-business equipment. Ask your IT provider to check them against the list and document which devices have been updated.

How nuVPN helps

• Encryption that starts on the device. With nuVPN, traffic is encrypted before it leaves your device, so people on the network cannot read it. It travels through an encrypted tunnel to a server that only you use.
• DNS inside the tunnel. All DNS queries pass through the encrypted tunnel. This keeps the list of websites you contact inside it as well.
• Kill Switch. If the tunnel disconnects, the connection is blocked. This prevents traffic from continuing outside the tunnel without you noticing.
• Your own server and IP address. The dedicated plan gives you a private server and a fixed IP address, with no other users on the connection and no shared attack surface.
• Enhanced protection mode. An advanced protocol that adds a layer of protection and is particularly suited to public Wi-Fi and untrusted networks.
• nuDefend protection, included in every plan. Websites your device looks up through nuVPN are checked against a list of more than 340,000 known dangerous sites. Every connection is checked, inbound and outbound, against about 50,000 addresses associated with known attackers. The lists are updated daily, and your account area shows the number of threats blocked for you.
• Protection for the whole home through your own router. Internet providers’ routers can be left as they are. The simple solution is to connect a small travel router to them and have your devices connect through it. nuVPN on your router also protects TVs, consoles and cameras that cannot run an app, from the moment they connect to its Wi-Fi.
• For teams. nuVPN for business provides one dedicated server for the whole team, with a fixed IP address, an encrypted tunnel and built-in blocking of phishing and malware domains for every device, wherever employees connect.

The bottom line

WPSplinter is a reminder that the router at home, in the office or in a hotel is a device most of us cannot inspect or update ourselves. According to the researcher, millions of access points are affected, and some are not expected to receive a fix. Rather than panic, you can act on two fronts at once: check your router, request an update and replace equipment that is no longer supported; and on every network you connect to, encrypt traffic on the device itself.