Broadcom's Wi-Fi SDK has a major security bug that can remotely hijack any router without requiring a password. It's important because it affects millions of devices around the world, making home and business networks vulnerable to remote hijacking. If you're using an affected device, you're in big trouble until a fix is in place.
Millions of devices remain exposed as no patches are available
The security problem lies in Broadcom's custom version of Wi-Fi Protected Setup (WPS). There are two memory safety bugs that can lead to remote code execution and root access. That means hackers can circumvent Wi-Fi passwords and the need to pair up over WPS. This is important because it affects a lot of networking devices since Broadcom's software is widely used.
These bugs have been present since at least 2010, with an attempt to address them in 2018 but not fully. A number of routers, gateways, and cable modems from big-name brands are affected. This includes routers from TP-Link, Cisco, Nokia, ZTE, Sagemcom, Netgear, etc. It's estimated that there are millions of wireless access points using Broadcom chips that could be compromised around the world.
This hasn't received a Common Vulnerabilities and Exposures (CVE) number yet. Broadcom says it's out of support for the software, but fixes aren't available for any tested devices. There's no CVE, which can make it harder to keep track of and address. At the moment, there's no official fix for those who own affected devices to keep their networks safe from this particular threat.
Discussion
0 comments
Log in to join the thread with a thoughtful take, question, or correction.