Home / Technology / Your Router is Vulnerable: 16-Year-Old Bug Exploited
Your Router is Vulnerable: 16-Year-Old Bug Exploited
20 Oct
Summary
- A 16-year-old Broadcom vulnerability, WPSplinter, is actively exploited.
- Millions of routers from major brands are potentially affected.
- Manufacturers and Broadcom have failed to provide a complete fix.
A severe security flaw, WPSplinter, affecting Broadcom software has been actively exploited for 16 years, potentially compromising millions of routers worldwide. Manufacturers including Asus, TP-Link, Netgear, Cisco, and Linksys are believed to be impacted by this vulnerability, which allows remote attackers to inject malicious code and gain control of devices.
The vulnerability stems from memory errors within Broadcom's Wi-Fi Protected Setup (WPS) implementation, which can be triggered by manipulated WPS codes. While Broadcom issued a partial update in 2018, eight years after the issue was first reported, it failed to fully resolve the problem and placed the onus on individual manufacturers.
As of July 2026, attempts to address the vulnerability with Broadcom and device makers have proven unsuccessful, with both parties deflecting responsibility. Security researcher Quentin Kaiser indicates that simply disabling WPS is insufficient to mitigate the risk, as exploitation remains possible. Identifying affected models is challenging, leaving users with limited recourse beyond contacting manufacturers directly.
