Millions of routers have a 16-year-old flaw that nobody plans to fix

Security researcher Quentin Kaiser has published a report regarding a 16-year-old bug that allows attackers to take control of various router models. The vulnerability lies deep within Broadcom software, potentially affecting millions of devices worldwide from well-known manufacturers like Asus, TP-Link, Netgear, Cisco, and Linksys—both consumer and business models.

The security vulnerability, known as WPSplinter, allows remote injection of malicious code and can lead to a takeover. It lies within Broadcom’s Wi-Fi Protected Setup (WPS) and makes routers vulnerable to memory errors when fed with manipulated WPS codes. Permissions can then be easily bypassed without the user even realizing it has happened.

Even though the vulnerability has been around for 16 years with proof that it was being actively exploited in the wild, there’s still no fix. Broadcom did release an update in 2018—eight years after the vulnerability was first reported!—that partially patched the flaw, but they then shifted the responsibility onto manufacturers, who were expected to adapt their own software to resolve the issue. Unsurprisingly, this did not happen.