WPSplinter: the 16-Year-Old Wi-Fi Flaw That Takes Your Router Without the Password

Your router is the one device in the building that everybody depends on and nobody thinks about. It sits in a corner, its lights blinking, quietly deciding what gets in and out of your network — your laptops, your phones, your point-of-sale terminal, the camera over the door. In October 2026, a researcher showed that for millions of those boxes, a stranger standing within Wi-Fi range can take the whole thing over without knowing your Wi-Fi password, without you clicking anything, and without the router ever receiving a fix. The flaw is called WPSplinter. And it is only the loudest item in a month full of router news.

The short version

• WPSplinter, disclosed October 16, 2026 by researcher Quentin Kaiser, is a flaw in Broadcom's Wi-Fi Protected Setup (WPS) code: malformed fragmented WPS EAP messages corrupt the router's memory and give an attacker within Wi-Fi range unauthenticated remote code execution as root — before any Wi-Fi association, so no password and no pairing step are needed.
• The vulnerable code dates to at least 2010. Broadcom shipped an incomplete patch in 2018 and later told manufacturers to move to open-source hostapd. No CVE was assigned, and no tested device had a working patch as of October 15, 2026.
• Switching WPS off in your router's settings is good hygiene, but it is NOT a verified fix for this flaw without manufacturer confirmation. Some affected chips are, in Kaiser's words, "forever day" — effectively unpatchable.
• October also brought 11 more router CVEs across three small-office brands, two CVSS-10.0 flaws in older models with no patch, an ASUS firmware round, and a reminder of what hijacked routers get used for: Mirai botnet recruitment.

In this post: The attack that skips the password entirely · A timeline with no patch at the end · Who has one of these boxes · The same month's other router news · Check your router in 10 minutes · What to do when there is no patch · Five things worth asking before you touch the router · Worth reading next to this · The box in the corner deserves a look tonight

The attack that skips the password entirely

Most people picture a router attack as someone guessing a password, or tricking you into clicking a link. WPSplinter is neither. It lives in Broadcom's proprietary implementation of Wi-Fi Protected Setup — the feature that was supposed to make connecting devices easier — and specifically in how that code reassembles fragmented WPS EAP messages, the handshake messages exchanged during Wi-Fi setup.

Send the router a specially crafted set of those frames, and the reassembly code corrupts its own memory. From there, the researcher demonstrated two things that should make any owner sit up. On an Orange Belgium gateway, an Askey TCG3000, he read the Wi-Fi password (the pre-shared key) out of the device's memory and sent it over the air — then used it to join the network. On a Proximus gateway, a Sagemcom BBOX3V+, he opened a reverse shell over Wi-Fi frames themselves, running commands on the router without any external server and without any cable. Both attacks needed no authentication at all.

The detail that makes this worse than an ordinary bug is the timing. The malicious frames are processed at the pre-association stage — before a device has joined the network, before any password is checked, before any normal access happens. There is nothing for the owner to click, no login to fail, no alert to notice. Anyone within ordinary Wi-Fi range — parked outside a house, sitting in a café below an office, walking a hotel corridor — is in position. Kaiser has reported no evidence of attacks in the wild, and this post does not claim otherwise. But the position required is an ordinary one, and the demonstration is public.

It also matters what a compromised router can do next, because a router is not just another device. It sees every connection that passes through it. A hijacked router can intercept traffic, harvest credentials typed into it, change where your devices go, and serve as a stepping stone into the rest of the network. For a home office or a small business, the router is the perimeter — and this flaw walks straight through it without knocking.

A timeline with no patch at the end

Read that timeline twice and notice what is missing: at no point does a fixed firmware version appear for the tested gateways. That is the story of this flaw. It is not a race to patch — it is a flaw whose patching path runs through manufacturers who were told years ago to replace the code, and largely did not.

Who has one of these boxes

There is no complete list of affected models, and anyone who offers you one is guessing. What exists is Kaiser's demonstrated pair, a firmware-analysis list, and a chipset list — and those three things are not the same. A chipset match alone does not prove a given firmware is vulnerable, so treat the table below as "check this", not "you are hacked".

The Belgium total of about 1.56 million routers is Kaiser's own estimate, built from subscriber numbers and market share, which he himself describes as medium-confidence napkin math — not a count of vulnerable devices. The honest reading is the order of magnitude: millions of Broadcom-based boxes worldwide carry this code, and which individual boxes are actually exploitable depends on the firmware they run. Your job is not to panic about a global number. It is to identify the one box in your corner and find out what it runs.

The same month's other router news

WPSplinter would be a big month on its own. October 2026 was not that kind of month.

Eleven flaws, three small-office brands, no patches. A cluster of CVEs disclosed within days of each other hits the Linksys E1700 (five flaws: CVE-2026-108892, a CVSS-10.0 stack buffer overflow giving remote code execution, plus four 9.9 command injections — CVE-2026-108893, 108894, 108895, 108896), the Netcore NR268 (CVE-2026-108907, CVSS 10.0 improper authentication, and CVE-2026-108929, a 9.9 DDNS argument injection), and the Edimax BR-6208AC (CVE-2026-108917 and 108918, both 10.0 command injections, plus CVE-2026-108914 and 108915, 9.9 buffer overflows). Public proof-of-concept exploits exist for several of them, and none of the three vendors had released fixed firmware at the time of reporting. These are the boxes that sit at the edge of home offices, remote-worker setups, and small branch locations — often without ever making it into an asset list.

Two maximum-severity flaws in older hardware, no patch coming. The TRENDnet TEW-751DR, TEW-752DRU, and TEW-733GR carry CVE-2026-108804, a CVSS-10.0 unauthenticated operating-system command injection in pigwidgeon.cgi, published October 12, 2026, with a public proof of concept. The devices reached end of life in 2011 and the vendor confirms no patch will arrive — replacement is the only durable fix. The TOTOLINK X6000R carries CVE-2026-105484, also CVSS 10.0, an unauthenticated command injection via the file_name field in firmware_check, published October 6, 2026, with no patched firmware confirmed; the mitigation is access control — keep the management interface off the public internet and switch WAN-side administration off.

ASUS: fixes for some, a new report for others. On October 7, 2026, ASUS released firmware updates for four flaws — CVE-2026-14911, CVE-2026-16528, CVE-2026-19386, and CVE-2026-19396 — across the 3.0.0.4_386, 3.0.0.4_388, and 3.0.0.6_102 series, with CVE-2026-14911 and CVE-2026-19386 scored CVSS 9.3 Critical and vectors including crafted configuration uploads and crafted links. Separately, a researcher reported an unauthenticated remote code execution flaw in ASUS routers, with CVEs assigned October 23, 2026 (CVE-2026-93489, CVE-2026-75779, CVE-2026-75775) and a vendor estimated fixed firmware date of November 15, 2026. This post does not repeat that researcher's headline audience figure as fact — it is his own unverified claim, and it is omitted here rather than dressed up as a number.

One vendor did ship a fix. NETGEAR's CVE-2026-11732 — insufficient input validation in the Block Sites feature, letting a network-adjacent attacker with Wi-Fi access run commands — is fixed in CAX30 V2.3.4.12, RAX30 V1.0.14.108, RAX5 V1.0.5.34, and RAXE300 V1.0.10.72. It applies only when the Block Sites feature is switched on, which is a useful reminder that a feature you never enabled cannot hurt you, and a feature you forgot about still can.

And a reminder of what hijacked routers become. On October 4, 2026, URLhaus listed 27 Mirai botnet files — builds named mirai.arm7, mirai.mips32, and the like — served from the domain likedrink.beer for routers, cameras, and other Linux devices. The domain no longer resolved when checked on October 11. That is not proof that any particular router is infected. It is a picture of the afterlife of a compromised router: recruited into a botnet, rented out for attacks on strangers, while its owner notices nothing worse than a slightly slow connection.

A router flaw is not a laptop flaw. Nobody reboots it, nobody updates it, nobody inventories it — and it guards everything behind it. That is why a month like this one deserves more than a shrug.

Check your router in 10 minutes

You do not need new software. You need ten minutes and the box itself. Work through this on the router that serves your home office or your business — not just the one in your head.

Your whole home network runs through the router: laptop, phone, TV, camera, smart speaker — one unpatched box exposes them all.

• Step 1 — Read the label. Flip the box over (or check its underside sticker) and write down the exact model and hardware version. "ASUS router" is not an answer; "DSL-AC68U, hardware version A" is.
• Step 2 — Log in and note the firmware. Open the admin page from a device on your own network, sign in, and write down the firmware version and its date. If you are still using the default admin password, change it right now — that is a separate, older problem, and it is free to fix.
• Step 3 — Ask the vendor two questions. On the vendor's support page for your exact model: is this model still supported, or is it end of life? And is there a firmware newer than the one you run? A model with no support left cannot be patched, whatever the flaw is.
• Step 4 — Look at WPS. Note whether WPS is on or off. Switching it off is sensible hygiene and Proximus did it fleet-wide — but remember the honest point from the top of this post: switching WPS off through standard settings is not a confirmed fix for WPSplinter without manufacturer confirmation. Treat it as reducing exposure, not as closing the hole.
• Step 5 — Kill remote administration. WAN-side administration must be off, and the management interface must not be reachable from the internet. If you can reach your router's login page from your phone's mobile connection (not your Wi-Fi), that is a problem to fix tonight, before anything else in this list.
• Step 6 — Make the replace-or-wait call. Patched and supported: you are done, and set a reminder to re-check in a quarter. Unpatchable, end of life, or no patch from the vendor: plan a replacement, and until it arrives, isolate the box — put untrusted devices on a guest network and keep the router's admin page off the internet. Waiting on a promised vendor patch: write down the promised date and re-check on that date instead of assuming it shipped.
• Step 7 — One honest note on rebooting. A reboot clears some transient malware from a router's memory, but it does not fix a flaw and it does not remove a persistent compromise. Reboot if you like; do not mistake it for a patch.

If you want a second pair of eyes on the result — especially the end-of-life question and the replace-or-wait call, which are the two places people most often guess wrong — a free assessment will run the router check with you, and the findings stay yours either way.

What to do when there is no patch

Most security advice assumes a patch exists and your job is to install it. This month breaks that assumption for a lot of routers, so the advice has to change shape.

First, separate the two questions people merge into one: "is my box vulnerable?" and "what do I do about it?" The first question may genuinely be unanswerable for your exact firmware — the researcher's list is incomplete, and a chipset match is not proof. That uncertainty is not a reason to do nothing. It is a reason to act on the second question with the information you do have: support status, firmware date, and exposure. A supported box with a vendor patch coming is a waiting game with a date on it. An end-of-life box with no patch coming is a replacement decision, not a monitoring task.

Second, shrink the blast radius while you wait. A router that cannot be reached from the internet, has remote administration off, and keeps untrusted devices on a guest network is a much less useful target than one left wide open — even if the underlying flaw is still there. None of that is a substitute for a patch. All of it is worth doing tonight, because it costs nothing and it helps against every router flaw in this post, not just WPSplinter.

Third, put routers on the same calendar as everything else you maintain. The reason this month's news is so bad is not only that the flaws are severe; it is that the devices involved go years without anyone looking at them. A quarterly ten-minute check — model, firmware date, support status — would have caught the end-of-life TRENDnet boxes years ago and would catch the next WPSplinter the week it lands. The businesses that get hurt by router flaws are rarely the ones with the worst routers. They are the ones with no routine at all.

Five things worth asking before you touch the router

Is my router affected by WPSplinter?

Maybe — and that is the honest answer until you check. If your box is one of the demonstrated ISP gateways, or a model confirmed by firmware analysis, or it runs a Broadcom chip from the listed families, put it on the check list. If you cannot identify the chip, use the model and firmware version: ask the vendor, or check the researcher's device list and detection tools. A chipset match alone does not prove your firmware is vulnerable, and an absent model from an incomplete list does not prove you are safe.

Does turning off WPS fix it?

Not as a verified fix, no. Kaiser is explicit: disabling WPS through standard router settings should not be considered a verified fix without manufacturer confirmation. Proximus switching WPS off fleet-wide is a mitigation while a full patch is prepared, not a patch. Do switch it off — it reduces exposure and costs nothing — but do not tick the box and move on.

Can someone exploit this from the internet, or do they have to be nearby?

WPSplinter itself needs Wi-Fi range — it is a radio attack, not an internet attack. That is reassuring only up to a point: "nearby" includes the street outside, the café downstairs, and the neighbouring office. And the other flaws in this post have different ranges — the TRENDnet and TOTOLINK command injections are remotely triggerable if the management interface is reachable, which is exactly why Step 5 of the check above matters for every router, not just the WPSplinter ones.

My router is on an affected list but my ISP or vendor says nothing — what do I do?

Contact them with your exact model and firmware version and ask three things: is my firmware affected, is a fix coming, and on what date? If there is no answer or no date, treat the box as unpatchable for planning purposes: isolate it and plan a replacement. Silence from a vendor is information, even when it is not the information you wanted.

I have one of the SOHO-cluster, TRENDnet, or TOTOLINK models — is replacing really the only fix?

For the TRENDnet models, yes — end of life since 2011, vendor confirms no patch, public exploit available. For the TOTOLINK X6000R and the three SOHO-cluster brands, no fixed firmware had been released at the time of reporting, so replacement is the durable answer and access control (management interface off the internet, WAN-side admin off, trusted networks only) is the bridge until it happens. A bridge is not a destination; do not let it become one.

Worth reading next to this

• PHP2Shell: the October 2026 PHP flaws, and the 15-minute check for your website — the same week's other headline flaw, and the same lesson from the other side of the stack: the layer underneath your code needs its own patch.
• Node2Shell (CVE-2026-111497): the Brotli Flaw in Node, Python, and Everything That Bundles It — one decoder bundled everywhere, and the inventory job that patching it actually requires.
• Your Microsoft 365 backup can be attacked too — the October 2026 lesson in connected access: a trusted connection, abused quietly, with no password needed.

The box in the corner deserves a look tonight

Here is the thing to carry out of this month: the router is the only device you own that every other device trusts completely, and it is the only one you never look at. A sixteen-year-old flaw, a cluster of maximum-severity bugs, and two end-of-life boxes with no patch coming all landed in the same few weeks — and most of them will still be sitting there, unpatched, in a year, because nobody put them on a calendar.

So put yours on one. Ten minutes tonight: model, firmware date, support status, remote administration off, and a replace-or-wait decision you can defend. That is the whole job, and it is smaller than the worry it replaces.

If the router menu is the last place you want to spend your evening, let our free assessment take the check off your plate — we'll look up the model, read the firmware dates, and give you the straight replace-or-wait answer. No obligation attached to it, and the findings are yours to keep.

Trust box — sources & review

• WPSplinter, disclosed October 16, 2026 by researcher Quentin Kaiser (talk at Hexacon, Paris): Broadcom proprietary WPS implementation, malformed fragmented WPS EAP messages, memory corruption, unauthenticated remote code execution as root within Wi-Fi range, pre-association stage, no password, no pairing step. Demonstrations: Orange Belgium Askey TCG3000 (Wi-Fi password/PSK extracted over the air); Proximus Sagemcom BBOX3V+ (reverse shell over Wi-Fi frames, no external server).
• Vulnerable SDK code dates to at least 2010; Broadcom incomplete patch 2018, later hostapd migration recommendation; no CVE assigned (Broadcom as CVE Numbering Authority declined; CERT/CC case closed August 4, 2026); no working patch on tested devices as of October 15, 2026; no evidence of in-the-wild attacks reported by Kaiser.
• Chipsets: eCos-based BCM3380, BCM3383, BCM33834 ("forever day"); Linux-based BCM3390, BCM65xx, BCM68xx (fix depends on manufacturer hostapd migration). Belgium estimate ~1.56 million (Kaiser's subscriber-based estimate, medium confidence — not a count): ~850,000 Proximus BBOX 3/3V+, ~500,000 VOO legacy fleet (Netgear CG3100, CG3700, Technicolor TC7210, CGA4233), ~210,000 Orange Belgium ASKEY TCG3000; Telenet says its fleet is not affected. Firmware-analysis models: Cisco RV110W, RV130W, RV215W; TP-Link Archer C3150, C5400, VR series; Netgear D6200, D7000; ASUS DSL-AC68U, DSL-AC88U, DSL-AX82U; ~40 D-Link DSL models; Zyxel, Sagemcom, Nokia, ZTE (list incomplete; chipset match alone does not prove a given firmware vulnerable). Responses: Proximus WPS off fleet-wide within 24 hours before the October 20 update, full patch expected "in the coming weeks"; Orange Belgium "actively looking"; VOO no response reported. Disabling WPS via standard settings is not a verified fix without manufacturer confirmation (Kaiser).
• SOHO cluster, October 2026: Linksys E1700 CVE-2026-108892 (10.0), CVE-2026-108893/108894/108895/108896 (9.9); Netcore NR268 CVE-2026-108907 (10.0), CVE-2026-108929 (9.9); Edimax BR-6208AC CVE-2026-108917/108918 (10.0), CVE-2026-108914/108915 (9.9); public PoCs exist; no fixed firmware from any of the three vendors at time of reporting.
• TRENDnet TEW-751DR/752DRU/733GR: CVE-2026-108804, CVSS 10.0, unauthenticated OS command injection in pigwidgeon.cgi, published October 12, 2026, public PoC, end of life since 2011, vendor confirms no patch.
• TOTOLINK X6000R: CVE-2026-105484, CVSS 10.0, unauthenticated OS command injection via file_name in firmware_check, published October 6, 2026, no patched firmware confirmed; mitigation is access control.
• ASUS October 7, 2026 firmware: CVE-2026-14911, CVE-2026-16528, CVE-2026-19386, CVE-2026-19396 across 3.0.0.4_386, 3.0.0.4_388, 3.0.0.6_102; CVE-2026-14911 and CVE-2026-19386 scored 9.3 Critical. Separate ASUS unauthenticated RCE report: CVEs assigned October 23, 2026 (CVE-2026-93489, CVE-2026-75779, CVE-2026-75775); vendor estimated fixed firmware November 15, 2026. The researcher's headline audience figure is omitted as unverified.
• NETGEAR CVE-2026-11732 (Block Sites input validation): fixed in CAX30 V2.3.4.12, RAX30 V1.0.14.108, RAX5 V1.0.5.34, RAXE300 V1.0.10.72; applies only when Block Sites is on.
• Mirai: October 4, 2026, URLhaus listed 27 Mirai botnet files served from likedrink.beer for routers, cameras, and Linux devices; domain no longer resolved as of October 11 checks.
• Reviewed: October 24, 2026. From Amen Security, a Winnipeg-based managed IT and web & app development team serving Canadian and US small and mid-sized businesses. No services, prices, partnerships, or certifications are claimed in this post beyond what the live site proves.