Security researcher Quentin Kaiser disclosed a flaw in Broadcom's proprietary Wi-Fi software at Hexacon on October 16, 2026. His report says attackers can execute code over Wi-Fi without knowing the network key. Router owners now need to establish whether their supplier has delivered corrected firmware.
He reports successful exploitation of Orange Belgium's ASKEY TCG3000 and Proximus's BBOX3V+, among other gateways. He says affected devices remained unpatched on October 15. These are the researcher's findings. MrKeyoor hasn't reproduced the attacks.
A fix still has to reach the router
Kaiser's disclosure timeline says Broadcom told him on July 28 that a patch was available and directed him to manufacturers. His account also describes an incomplete 2018 patch and a recommendation to migrate to hostapd, an alternative implementation. Customers still need an answer about their actual firmware build.
The demonstrated devices are in Belgium. His wider exposure estimates aren't a device census and don't establish a worldwide total.
What the detection tools can establish
The accompanying Broadcom 802.11 SDK Detection Toolkit supports firmware inspection with YARA rules and live access-point fingerprinting. A Broadcom chip alone doesn't establish exposure: the documentation says vendor-specific radio information can appear even when the device uses different software.
The toolkit's YARA rules are triage aids. Compiler differences can hide a match, while patched binaries can retain matching strings or code. The README calls for source inspection or manual review of the fragment-length checks before treating a match as confirmation.
For administrators, that separates two jobs: inventorying suspect equipment and verifying the firmware's vulnerable code path. The project's affected-device list is explicitly incomplete. An omitted model doesn't establish safety, and a detector result doesn't supply a fixed firmware version.
Watch for manufacturers and ISPs to identify corrected builds for named models. Kaiser's July exchange points to those suppliers as the route to remediation. Customers can ask which firmware addresses the reported parser flaw and whether it has reached their router.