Broadcom Wi-Fi Flaw from 2018 Still Exposes Millions of Routers to Remote Hijacking

Why This Sixteen-Year-Old Bug Still Matters Today

A critical vulnerability in Broadcom Wi-Fi chips, first identified in 2018, continues to leave millions of internet-connected devices open to remote takeover by attackers, according to a security researcher who disclosed the issue this week. The flaw, which affects routers and embedded systems using the chipmaker’s wireless firmware, allows unauthenticated attackers within Wi-Fi range to execute arbitrary code and gain full control of affected devices without needing passwords or user interaction. Despite Broadcom being notified years ago, many consumer and industrial devices remain unpatched due to fragmented update processes and lack of transparency from manufacturers.

The vulnerability resides in the Broadcom Wi-Fi FullMAC chipset’s handling of specially crafted wireless frames, a flaw that enables buffer overflow exploitation. Security researcher Emiliano Bersani, who rediscovered and analyzed the issue, noted that while Broadcom released internal patches in 2018, the fix never propagated widely to end-user devices. „The chip vendor did their part, but the burden fell on device makers who often don’t prioritize firmware updates for older hardware,” Bersani explained. Millions of routers, IoT gadgets, and even industrial control systems using these chips may still be running vulnerable firmware, especially in regions where ISPs delay or skip updates. The attack requires only proximity to the target network, making it particularly dangerous in dense urban or shared environments.

Could Your Router Be at Risk Right Now?

Devices most at risk include older models from major networking brands that rely on Broadcom’s wireless chipsets, particularly those not receiving regular firmware updates. Unlike vulnerabilities requiring user interaction or network misconfiguration, this flaw can be triggered passively by sending malicious packets over the air. Once exploited, attackers can intercept traffic, launch further network intrusions, or use the router as a pivot point to access connected devices like cameras, storage systems, or smart home controllers. Bersani emphasized that detection is difficult without deep packet inspection, and most users would notice no outward signs of compromise. He urged network administrators to audit device firmware versions and consider network segmentation to limit potential damage.

Frequently Asked Questions

How can I tell if my router uses a vulnerable Broadcom chip? Check your router’s model number and specifications on the manufacturer’s website or admin interface; look for Broadcom Wi-Fi chipsets in the hardware details, especially if the device is several years old and no longer receiving updates.

Is there a way to fix this if my vendor won’t update the firmware? If official updates are unavailable, consider replacing the device with a model that receives regular security patches, or isolate it on a separate network segment with strict firewall rules to minimize exposure if compromised.