A key is not required to reach every parser.
Security researcher Quentin Kaiser published a report about a fragment reassembly flaw in Broadcom's proprietary WPS implementation. Kaiser says the affected code has been in the SDK since at least 2010, an incomplete patch appeared in 2018, and Broadcom later recommended moving to hostapd. The report says a crafted Wi-Fi exchange can reach the flaw without knowing the network key or completing normal WPS enrollment.[1]
The report claims controlled information disclosure and code execution on tested devices. It names eCos and Linux chip families, several Belgian provider gateways, and a much wider set of products under investigation. These are the researcher's findings. Pimp My IDE did not reproduce the attack.
The internet edge is not the only remote edge. A radio frame can reach code before your routed firewall sees a session.
Do not turn a model list into a verdict.
Kaiser's companion repository contains a firmware YARA rule and a live fingerprinting script. The README calls both triage aids. Its static rule can retain matches in a patched binary. Compiler changes can also evade the opcode pattern. The live script combines Broadcom information elements with a behavior difference between the proprietary WPS monitor and hostapd.[2]
That creates four useful evidence levels. A model or vendor match starts inventory. Broadcom strings or information elements make a candidate. The implementation behavior can support a likely assessment. Firmware review or a provider's exact patch record is still needed for a device decision.
The toolkit was inspected at revision 65457b38e63349fcda02a2eeee1f9448849b5af7. The fingerprint script's SHA-256 was be584da942f323aa204e3d8e2e13b5b5c2e6262f91633a3ddc97ab0d7054d447. Those facts identify the source inspected. They do not prove that the script is safe for every adapter, legal on every network, or accurate for every firmware build.
Patch evidence has to name the installed box.
Start with the label and management page. Record the provider, manufacturer, model, hardware revision, firmware version, and update channel. Ask the provider whether that exact firmware uses Broadcom's proprietary WPS monitor, hostapd, or another implementation. Ask for the fixed version and deployment date.
Disabling the WPS button or web setting may reduce exposure, but a settings screen does not prove that the parser stopped receiving frames. Treat it as a temporary control until the vendor explains the code path. If the gateway cannot receive a fixed build, replacement is the clean route. Put the date and owner in the ticket.
Wi-Fi proximity is a network route.
This flaw report is separate from Volexity's 2024 "Nearest Neighbor" investigation. Volexity described an attacker who compromised nearby organizations and used dual-homed systems to reach a target's Wi-Fi from thousands of miles away. That incident did not use the Broadcom parser flaw.[3]
The architectural lesson still applies. Physical radio range does not guarantee a nearby operator. Inventory access points as exposed infrastructure. Keep wireless controller logs. Separate guest, wireless, and sensitive wired networks. A gateway replacement plan belongs beside the firewall plan.
Build one response packet.
GATEWAY_PROVIDER=[REQUIRED]
MANUFACTURER_MODEL=[REQUIRED]
HARDWARE_REVISION=[REQUIRED]
FIRMWARE_VERSION=[REQUIRED]
WPS_IMPLEMENTATION=[REQUIRED]
EVIDENCE_SOURCE=[REQUIRED]
FIXED_VERSION=[REQUIRED]
DEPLOYMENT_DATE=[REQUIRED]
TEMPORARY_CONTROL=[REQUIRED]
REPLACEMENT_OWNER=[REQUIRED]
REPLACEMENT_DEADLINE=[REQUIRED]The blast shield below drafts the next action for the evidence you have. It does not scan a network, inspect firmware, or establish that a gateway is vulnerable.