{"rewrite":{"id":"r_1f0c8b78ad28d6e92ffbe7a7","clusterId":"c_6ac9aa116da794bb03b54531","slug":"broadcom-wi-fi-flaw-since-2010-remains-unfixed-as-eternal-zero-day","model":"deepseek-v4-1-flash","headline":"Broadcom Wi-Fi Flaw Since 2010 Remains Unfixed As Eternal Zero-Day","summary":"Security researcher Quentin Kaiser demonstrated a Broadcom SDK flaw that lets an attacker extract the Wi-Fi pre-shared key from NVRAM over 802.11 without knowing the password. The vulnerability has existed at least since 2010. Broadcom learned of it in 2018, declined to assign a CVE or disclose it publicly, and released only an incomplete patch before replacing the component with hostapd in a newer SDK. Kaiser estimates dozens of vendors and millions of access points are affected.","whyItMatters":"Broadcom has known about this flaw since 2018 and still declines to assign a CVE, so the fix depends on OEMs migrating to a newer SDK that the affected devices may never receive.","webCardHtml":"\u003cp\u003eKaiser connected to a target network with the extracted key and confirmed the device stayed stable and the key was correct. He cited Belgium as an example: he confirmed the flaw at three of the country\u0026#39;s four major ISPs and demonstrated exploitation there.\u003c/p\u003e\u003cp\u003eBroadcom\u0026#39;s answer is migration to the newer SDK. Kaiser\u0026#39;s point is that this leaves the old component in place as an unfixed zero-day for anyone who does not move, and he names dozens of vendors, hundreds of products, and millions of access points as the scope. He also credits AI with cutting the analysis from months to under a week.\u003c/p\u003e","blueskyPost":"Broadcom knew about the NVRAM key extraction in 2018 and declined to assign a CVE. Refusing the identifier kept the flaw off the databases defenders scan, so routers stayed exposed for years after the company had a patch in hand.","twitterPost":"Broadcom learned of the flaw in 2018 and declined to assign a CVE. No identifier means no entry defenders scan, so the 2010 bug stayed quiet.","threadsPost":"Broadcom learned of Kaiser's flaw in 2018 and chose not to assign a CVE. That decision is the part worth sitting with: without an identifier the flaw has no entry in the databases defenders scan, so a bug dating to 2010 stayed quiet while an incomplete patch went out.","newsletterBlurb":"Quentin Kaiser demonstrated a Broadcom SDK flaw that leaks the Wi-Fi pre-shared key from NVRAM over 802.11 without the password, and confirmed it at three of Belgium's four major ISPs. Broadcom has known since 2018 but declined a CVE and public disclosure, releasing only an incomplete patch before swapping the component for hostapd in a newer SDK.","attributionJson":"[{\"source\":\"GIGAZINE\",\"url\":\"https://gigazine.net/news/20261021-wpsplinter/\",\"title\":\"Wi-Fi flaw existing since 2010 allows router takeover without knowing the password, potentially affecting millions of devices\"}]","lintFlagsJson":null,"lintHits":0,"costUsd":0,"inputTokens":4576,"outputTokens":617,"status":"published","repairAttempts":0,"nextRepairAt":null,"factsAttemptedAt":1792588027,"createdAt":"2026-10-21T13:01:47.000Z","publishedAt":"2026-10-21T13:06:06.000Z","updatedAt":"2026-10-21T13:06:06.000Z"},"cluster":{"id":"c_6ac9aa116da794bb03b54531","canonicalTitle":"2010年から存在するWi-Fiの欠陥でパスワードを知らなくてもルーターを乗っ取れるバグが発覚、数百万台が影響を受ける可能性","representativeArticleId":"a_e49d9c181e1df47a606e008a","sourceCount":1,"writtenSourceCount":1,"writeAttempts":0,"isSolo":true,"entitiesJson":"{\"anime_titles\":[],\"manga_titles\":[],\"work_titles\":[],\"studios\":[],\"people\":[],\"type\":\"news\",\"domain\":\"other\",\"is_roundup\":false}","contentType":"news","status":"published","firstSeenAt":"2026-10-21T12:00:00.000Z","lastSeenAt":"2026-10-21T12:00:00.000Z","updatedAt":"2026-10-21T13:06:06.000Z"},"attribution":[{"source":"GIGAZINE","url":"https://gigazine.net/news/20261021-wpsplinter/","title":"2010年から存在するWi-Fiの欠陥でパスワードを知らなくてもルーターを乗っ取れるバグが発覚、数百万台が影響を受ける可能性"}],"entities":{"anime_titles":[],"manga_titles":[],"work_titles":[],"studios":[],"people":[],"type":"news","domain":"other","is_roundup":false},"keyFacts":null}