A 16-year-old bug could be putting millions of routers at risk — despite Broadcom saying it patched the issue…
- A Broadcom WPS flaw dating back to at least 2010 lets attackers within Wi-Fi range run code on routers without the password
- Broadcom told the researcher it replaced the code from 2018, but declined to assign a CVE, calling the software obsolete
- Changing your Wi-Fi password won't help, and disabling WPS may not either; firmware updates or replacement are the fix
A flaw in Broadcom's Wi-Fi software dating back to at least 2010 lets anyone within radio range take over a vulnerable router without its password, and the fix Broadcom says it shipped years ago never reached many routers that need it.
Security researcher Quentin Kaiser presented the bug at the recent Hexacon event alongside a detailed write-up, naming it 'WPSplinter', a name he admits to disliking; with no CVE assigned, it is the only label the flaw has.
The bug sits in Broadcom's legacy WPS Monitor, the component...
Copyright of this story solely belongs to www.techradar.com. To see the full text click HERE
