16-Year-Old Broadcom Wi-Fi Bug Lets Attackers Take Over Routers Without a Password

A Broadcom Wi-Fi flaw dating back to 2010 allows attackers within Wi-Fi range to execute code on vulnerable routers without authentication.

The bug allows an attacker to get unauthenticated remote code execution on affected routers without knowing the WiFi password or going through the normal WPS setup process.

An attacker within Wi-Fi range can exploit the flaw without knowing the Wi-Fi password, completing the setup process, or requiring any action from the user.

In his demonstration, Kaiser extracted the Wi-Fi password from the router’s memory and sent it over the wireless connection.

The code retrieves the Wi-Fi password (PSK) from the router’s NVRAM and sends it back to the attacker over Wi-Fi.