Broadcom Wi-Fi Flaw Since 2010 Remains Unfixed As Eternal Zero-Day
Broadcom has known about this flaw since 2018 and still declines to assign a CVE, so the fix depends on OEMs migrating to a newer SDK that the affected devices may never receive.
Reporting from 1 source: GIGAZINE.
Security researcher Quentin Kaiser demonstrated a Broadcom SDK flaw that lets an attacker extract the Wi-Fi pre-shared key from NVRAM over 802.11 without knowing the password. The vulnerability has existed at least since 2010. Broadcom learned of it in 2018, declined to assign a CVE or disclose it publicly, and released only an incomplete patch before replacing the component with hostapd in a newer SDK. Kaiser estimates dozens of vendors and millions of access points are affected.
Kaiser connected to a target network with the extracted key and confirmed the device stayed stable and the key was correct. He cited Belgium as an example: he confirmed the flaw at three of the country's four major ISPs and demonstrated exploitation there.
Broadcom's answer is migration to the newer SDK. Kaiser's point is that this leaves the old component in place as an unfixed zero-day for anyone who does not move, and he names dozens of vendors, hundreds of products, and millions of access points as the scope. He also credits AI with cutting the analysis from months to under a week.
Synthesized by Yomimono from the 1 cited source below, including Japanese-language reporting where cited, then editorially reviewed before publishing.