A critical remote code execution vulnerability in Broadcom's proprietary WiFi implementation has been confirmed to affect dozens of vendors and hundreds of products worldwide. The flaw, present in the SDK since at least 2010, allows unauthenticated attackers to gain full control of affected devices over WiFi without knowing the network password. Exploitation does not require WPS enrollment and can be triggered from several kilometers away.

The vulnerability stems from an incomplete patch silently released in 2018. Broadcom recommended migrating to hostapd, but many original equipment manufacturers have not implemented fixes. Security researcher Akari discovered the issue affects multiple Belgian internet service providers, including Proximus (BBOX 3V+), VOO (Netgear CG3100, CG3700, Technicolor models), and Orange Belgium (ASKEY TCG3000). Additional potential impact exists across broader markets involving BCM3390, BCM65xx, and BCM68xx chipsets.

Exploitation demonstrated in controlled tests achieved remote code execution, enabling retrieval of network passwords from memory and establishing persistent access. Video evidence showed successful attacks against Proximus and Orange Belgium customer premises equipment. Affected devices remained unpatched as of October 15, 2026, despite a 90-day coordinated disclosure process initiated July 18, 2026.

The researcher noted that artificial intelligence tools reduced research time from months to days, highlighting how modern capabilities accelerate vulnerability discovery. The flaw's longevity—existing for 16 years—reflects accumulated technical debt in network infrastructure. Affected vendors have not publicly acknowledged the issue or assigned a CVE identifier, complicating mitigation efforts. This incident underscores risks in complex wireless implementations and the challenges of coordinating timely fixes across global supply chains.