Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers
A flaw in Broadcom’s Wi-Fi setup software allows an attacker within radio range to execute code as root on Broadcom-based routers without needing the network password or any pairing steps. Security researcher Quentin Kaiser revealed this vulnerability on October 16.
Kaiser demonstrated the attack on home gateways provided by three Belgian internet service providers. In one instance, he was able to retrieve the Wi-Fi password from the device, and in another, he opened a remote shell over the air. No Common Vulnerabilities and Exposures (CVE) identifier has been assigned to this flaw, and no fixes have been implemented on the affected routers, according to Kaiser.
The vulnerability lies in Broadcom’s implementation of Wi-Fi Protected Setup (WPS), a feature that allows devices to join a Wi-Fi network without entering the password. The issue arises from how Broadcom’s code handles the reassembly of fragmented WPS setup messages, enabling an attacker within range to send specially crafted messages that corrupt the router’s memory. Kaiser developed two exploits: one to read memory from the device and another to execute his own code.
Demonstrated Exploits
In an attack against an Orange Belgium gateway, the Askey TCG3000 was able to read the Wi-Fi password (the Pre-Shared Key) from the router’s stored settings and send it back over the air, subsequently joining the network using that password.
In a separate attack on a Proximus gateway, the Sagemcom-built BBOX3V+ exploit opened a reverse shell, allowing remote command execution over Wi-Fi frames, negating the need for an external server.
Both attacks were executed without any login requirements, and Kaiser noted that the exploit works from a distance, not just up close. He has not reported any real-world attacks utilizing this vulnerability, and the working exploits are his own creations.
Scope of the Vulnerability
Broadcom’s WPS code is integrated into routers and access points from numerous vendors, with Kaiser estimating that millions of devices globally are affected. The vulnerable chips fall into two categories: older eCos-based models (BCM3380, BCM3383, and BCM33834), which he describes as having a permanent
Source: The Hacker News