GoKawiilResearcher details unpatched Broadcom WiFi flaw exploitable on millions of routers
A security researcher disclosed a vulnerability in Broadcom's proprietary 802.11 parser that has existed in its SDK since at least 2010, with an incomplete fix issued quietly in 2018. The bug can be triggered remotely over WiFi without the network password, enabling information disclosure and remote code execution, and the researcher demonstrated working exploits against routers from three of Belgium's four major ISPs. Broadcom has reportedly known of the issue since 2018, declined to assign it a CVE or disclose it publicly, and instead recommended OEMs migrate to hostapd rather than patching directly.