Millions of routers can be attacked remotely due to a Broadcom failure that affects Spanish operators

A security investigation published by specialist Quentin Kaiser has brought to light a really serious vulnerability. Affects the proprietary implementation of the 802.11 standard in the Broadcom SDK. The problem, named WPSplinteris located in the analyzer responsible for reassembling EAP packets within the WPS protocol. Perhaps the strongest thing is that it has been present in the manufacturer’s code since at least 2010.

The severity of the flaw lies in how easy it is to exploit it over the wireless interface. In fact, the report explains, an attacker located in the range of the signal does not need to know the password of the WiFi network or complete a regular WPS synchronization to launch the exploit.

By sending specific frames over the air, it is possible to cause a memory overflow that grants remote code execution with maximum privileges and allows you to extract the security key stored in the NVRAM memory of the device in a matter of seconds. As you can see, we are not exaggerating when we tell you that this is an extremely serious issue.

The risk of someone taking control of your network from across the street

Although Broadcom distributed a partial patch in 2018 and recommended manufacturers migrate to open implementations like hostapd, the company did not assign a CVE identifier or issue public statements about the incident. As a direct consequence of this lack of warning, dozens of brands continued to integrate the vulnerable code into equipment that has ended up in millions of homes.

In the case of Spain, it affects widespread devices on lines contracted by SMEs and domestic users. Among the equipment identified are the well-known first generation HGU routers, such as the Askey RTF3505VW and the MitraStar GPT-2541GNACdistributed by Movistar and O2, in which it has been confirmed that the most recent firmware revisions continue to be exposed. We leave you the image below so you can easily recognize it.

The problem also affects models such as ZTE F680 v4 present in MásMóvil and Jazztel clients, Comtrend VG8050 or to Sagemcom Fast 5656 associated with Orange, Jazztel and Simyo. On many of these devices, disabling the WPS feature from the administration panel does not eliminate the attack vector if the internal process continues to run in the background.

As an additional note, the specialized media BandaAncha has contacted the main operators in Spain to see if they already have corrective patches for their installed device fleet, but at the moment no official response has been received in this regard.

List of brands and models identified in the investigation

The manufacturers and models included in the researcher’s technical report are detailed below. In the table they have been marked in bold the equipment whose presence and use have been documented in Internet providers within Spanish territory. In any case, the GitHub opened for the incident warns that this list could be incomplete.

Here are all the models documented for now: