An attacker in radio range can run root on Broadcom-based routers without the wifi password, without pairing, and without a single packet hitting your firewall.

Quentin Kaiser disclosed the bug on October 16. He showed it working against home gateways supplied by three Belgian internet providers. In one case he pulled the wifi password off the device after he already owned it. Most cybersecurity programs still file those boxes under ISP equipment and move on. That filing cabinet is now an access path.

Radio range skipped the login stack

Kaiser’s write-up is blunt about the reach. The flaw lives in Broadcom’s wifi setup software. If you can hear the radio, you can talk to the vulnerable service. You do not need the PSK. You do not need WPS. You do not need a stolen laptop that once joined the SSID.

The password was a trophy, not a lock.

That should rearrange how you budget attention on brute-force noise at the WAN. Guessing SSH on a public address is loud, logged, and usually aimed at a host you actually manage. This path is quiet, local, and aimed at hardware your change ticket cannot reboot. A parking lot. A hallway. The apartment next door. Radio range is the only ticket.

MITRE ATT&CK v20 just shipped 15 new detection strategies, six for Enterprise and nine for ICS, backed by 38 analytics. The catalog now spends real space on MFA bypass, AI abuse, and industrial targeting. Useful work. The Broadcom bug never presents a login. Your threat detection rules that watch failed MFA, impossible travel, and token replay will sit idle while someone roots the box that hands out DHCP and DNS to every laptop on the SSID.

Defense in depth assumed the access point was a dumb radio behind a managed edge. On a lot of hybrid networks the access point is the edge. The corporate laptop, the split-tunnel VPN, the SSO cookie: all of it rides a rented Broadcom chip that the provider has not patched.

Home gateways sit outside cybersecurity programs

Ask your last incident response tabletop who owns the employee’s home gateway. You will get a shrug, then a slide about endpoint agents. The agent sits on the laptop. The laptop trusts the LAN. The LAN is the ISP’s Broadcom board. Nobody in that chain has a patch window.

Security hardening checklists still start at the office firewall and the identity provider. They almost never include “enumerate CPE chipsets on staff home networks” or “assume the local SSID is hostile.” That gap is practical, not academic. Kaiser did not need a Windows zero-day. He needed proximity and an unpatched setup service.

Your SOC never saw the session.

Threat-protection stacks that only watch north-south traffic will miss a local root that never leaves the radio. After the box is owned, the attacker can read the wifi password, stand up a rogue DHCP path, or sit on DNS. From there the laptop’s corporate session is a browser away. Cyber security scorecards that glow green on phishing click rates and MFA enrollment can still hide a rooted radio in the den.

You cannot treat this as a consumer curiosity. The workforce already lives on these gateways. Contractors. Executives. The helpdesk analyst who approved a password reset at 11 p.m. Their trusted network is a plastic box with a Broadcom radio and a firmware train you do not control. If your program stops at the corporate SSID, you have drawn the perimeter in the wrong building.

Treat rented radios as hostile hardware

Stop waiting for a provider CVE mail that may never arrive. You need controls that still work when the home gateway is already rooted.

Do the immediate work this week. Force company devices onto a cellular tether or a known-good travel router when staff handle privileged work from home. Kill split tunnel for admin paths. Require that privileged browsers and PAM sessions refuse RFC1918 captive networks you do not manage. Inventory who still uses the ISP gateway as their only hop, especially anyone with directory, backup, or cloud-console rights. On managed endpoints, disable auto-join for home SSIDs that fail certificate-based wifi, and alert when a domain-joined device accepts a gateway that hands out DNS you did not deploy. If you cannot do 802.1X at home, put a company access point or a locked-down travel router in front of the ISP box and treat the ISP radio as untrusted WAN.

Keep doing the boring follow-through. Add unmanaged CPE to tabletop incident response and practice the case where an attacker already has LAN position at an employee’s house. The playbook should rotate tokens, dump DHCP and DNS history on the endpoint, and assume the wifi PSK is public. Do not wait for a firewall log that will never exist. Push providers, in writing, for Broadcom setup-service status, firmware versions, and a way to disable the vulnerable listener. Track the answers. If they stall, move privileged users off that CPE.

You will not get a clean patch SLA on hardware you rent. Plan for a rooted radio, then make the laptop refuse to trust it.

Sources

• Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers
• MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks