WPSplinter: The Broadcom WPS Flaw in ISP Gateways, Which Models Are Listed, and How to Turn Off WPS

Last updated: November 2026

This guide is for anyone whose internet comes through an ISP-supplied gateway or an older modem router. It explains WPSplinter, a flaw in Broadcom's WiFi Protected Setup (WPS) code that has no fix for many devices, lists the US gateway models that appear on the researcher's affected list, shows how to turn WPS off on the common brands, and explains why that step alone may not be enough. Details were checked on November 12, 2026 against the researcher's write-up and documentation, Broadcom's public statements as reported there, and the US government's catalog of exploited vulnerabilities.

Key Takeaways

• WPSplinter is a memory bug in Broadcom WPS code used in cable, DSL and fiber gateways since about 2010. An attacker within WiFi range, with no password, can read the WiFi password from memory and, on some devices, run code as root. There is no CVE number, and Broadcom has declined to assign one.
• The researcher's list names gateways issued by Xfinity, AT&T, CenturyLink and Frontier, plus older NETGEAR, Cisco and ASUS DSL routers. The list is not complete, and no attacks in the wild had been reported as of November 12, 2026.
• Turning off WPS is the right first step, but the researcher warns not to assume it removes the vulnerable code. A firmware update from your ISP or the manufacturer is the only real fix, and a modem with no WiFi radio has no WPS to attack.

What is WPSplinter?

WPSplinter is the name security researcher Quentin Kaiser gave to a pair of bugs in the WPS parser inside Broadcom's 802.11 software development kit. He presented the work at the Hexacon conference in Paris and published a write-up on October 16, 2026, with a follow-up on October 20 and public documentation listing affected chips and devices.

WPS is the push-button or PIN pairing feature that lets a device join WiFi without typing the password. The bug sits in the code that reads WPS messages over the air. Because WPS messages are accepted before a device has authenticated, an attacker needs only to be within radio range. The researcher demonstrated reading device memory, recovering the WiFi passphrase (the PSK), and running code with root privileges.

The affected software runs on two families of Broadcom chips. On the older eCos operating system: BCM3380, BCM3383 and BCM33834, which are the cable modem chips in many DOCSIS 3.0 gateways from the early 2010s. On Linux: BCM3390, the common DOCSIS 3.1 gateway chip, plus the BCM63xx, BCM65xx and BCM68xx families used in DSL and fiber gateways.

Why is there no patch and no CVE?

Broadcom has known about the parser since 2018, when it shipped a fix that the researcher's October 23 follow-up shows was incomplete. According to the write-up, Broadcom told equipment makers to move to a different WPS implementation (hostapd), said the affected software is obsolete and outside its support window, and declined to assign a CVE or comment publicly. CERT/CC closed its coordination case on August 4, 2026. The researcher reports that Broadcom said on July 28, 2026 that a patch is available to manufacturers, but whether any given gateway receives it is up to the manufacturer and the ISP.

A flaw with no CVE is easy to miss. Vulnerability scanners, ISP security teams and news coverage all key off CVE numbers. That is why a sixteen-year-old bug in tens of millions of devices has drawn less attention than a routine router advisory.

Which US gateways and routers are on the affected list?

The researcher's documentation carries a device list that it describes as not exhaustive. These are the entries most likely to be in a US home, grouped by the provider that issues them. Many are older models, but ISP gateways stay in service for a decade.

Two things the list does not settle. First, the researcher confirmed the bug on specific firmware builds; a newer build on the same model may or may not carry the fix. Second, a model that is not listed is not confirmed safe. Any gateway built on the chips above that still runs Broadcom's WPS code is a candidate. The Belgian operators where the research began, Proximus, Orange Belgium and VOO, use NETGEAR, Technicolor and ASKEY cable gateways on the same chips that US cable operators buy.

Is a modem-only unit affected?

No WiFi radio, no WPS. The attack arrives over the air as a WPS message, so a cable modem with no wireless function has nothing to receive it. The researcher's documentation does not address modem-only devices directly, so this is reasoning from how the attack works rather than a statement from the source. A standalone DOCSIS 3.1 modem such as the ARRIS SB8200 or NETGEAR CM1000 uses the BCM3390 chip but has no WiFi, and a router you own behind it is the device that handles WPS.

That split is the point of owning your equipment. The modem does one job and your ISP does not control its WiFi settings, because it has none. The router is a device you can update, replace or flash yourself. Our guide to why owning your modem is a privacy step covers the broader case.

How do I turn off WPS on my gateway?

Turn it off regardless. WPS has a long record of flaws apart from this one, and nothing in a modern home needs it; every phone, laptop and smart device can join with the password or a QR code. The setting lives in the wireless section of the admin page. The paths below are the usual ones; your firmware version may label things differently.

1. Xfinity xFi gateways: connect to the gateway's WiFi, open 10.0.0.1 in a browser, sign in, and go to Gateway, then Connection, then WiFi. Open the settings for each band and look for a WPS or WiFi Protected Setup toggle. Some Comcast firmware shows no WPS control at all, in which case you cannot change it, and the fix is in Comcast's hands.
2. AT&T BGW210 and BGW320: open 192.168.1.254, choose Home Network, then Wi-Fi. The Device Access Code printed on the gateway is required. Look for WPS under the advanced wireless options and set it to Off.
3. CenturyLink Actiontec, Zyxel and Technicolor: open 192.168.0.1, sign in with the admin credentials printed on the unit, choose Wireless Setup, then WPS, and set it to Disable. Apply the change.
4. NETGEAR routers: open routerlogin.net, go to Advanced, then Advanced Setup, then Wireless Settings. Under WPS Settings, check Disable Router's PIN, and if a "Keep Existing Wireless Settings" option is present, enable it.
5. ASUS DSL routers: open router.asus.com, choose Wireless, then the WPS tab, and set Enable WPS to Off.

Then read the researcher's caution. His documentation says, in answer to whether turning WPS off helps, "Do not assume so," because a settings toggle may stop advertising WPS without unloading the code that parses WPS messages. Proximus, the Belgian operator, disabled WPS across its fleet as an interim measure while waiting on firmware, which tells you how operators are treating it: worth doing, not sufficient.

What else reduces the risk?

The attack needs radio proximity, so the risk is highest in apartments, dorms and dense neighborhoods, and lowest for a detached house with a long driveway. Beyond turning off WPS:

• Ask your ISP, in writing, whether your gateway model has received the Broadcom WPS fix and what firmware version carries it. Keep the reply.
• If you can, put the ISP gateway in bridge mode and run your own router. Bridge mode alone does not always power down the gateway's radio, so also turn the gateway's WiFi off after bridging. Our bridge mode guide covers Xfinity, AT&T, Spectrum, Fios, Cox and CenturyLink.
• Replace eCos-era cable gateways. The BCM3380 and BCM3383 chips date from the DOCSIS 3.0 era, and the researcher notes that older eCos devices may have no migration path to fixed software. Our DOCSIS 3.1 modem guide lists current replacements by provider.
• Treat the WiFi password as compromised if you have reason to think someone targeted you. Change it, and change the admin password at the same time.
• Keep smart home devices on a separate network so a compromised gateway does not hand an attacker your whole house. Our VLAN guide walks through it.

FAQ

Has WPSplinter been used in real attacks?

No public report says so. The researcher's write-up does not claim in-the-wild use, and the flaw has no CVE, so it cannot appear in CISA's Known Exploited Vulnerabilities catalog as of November 12, 2026. A PCWorld summary that described it as exploited in the wild was not supported by the researcher's own documentation.

Is my cable modem affected if it has no WiFi?

The attack is delivered over WiFi as a WPS message, so a modem-only device with no radio has no way to receive it. The researcher's pages do not address modem-only units directly.

Does turning off WPS fix WPSplinter?

Not reliably. The researcher's documentation says "Do not assume so," because the vulnerable parser may remain loaded with WPS switched off. Turn it off anyway, and ask your ISP for firmware that removes the Broadcom WPS code.

Is the ARRIS SB8200 or NETGEAR CM1000 affected?

Neither appears on the researcher's list, and neither has a WiFi radio. Both use the BCM3390 chip, which is in the affected family, but without a radio there is no WPS message path.

Why doesn't WPSplinter have a CVE number?

Broadcom is the authority that assigns CVEs for its own products, and the researcher reports that it declined. CERT/CC, which coordinates disclosures, closed its case on August 4, 2026 without a CVE being issued.

Which Xfinity gateways are affected?

The list names the ARRIS/CommScope X5001. Comcast has not published a statement about WPSplinter that we could find, and Comcast gateways receive firmware only from Comcast.

Sources and how this article was reported

Technical details, chip families and the device list come from Quentin Kaiser's write-up and documentation, read on November 12, 2026. Broadcom's position is as reported by the researcher; Broadcom has not commented publicly. We did not contact Broadcom, Comcast or AT&T for comment. Admin page paths are from each manufacturer's documentation and may differ by firmware version. ModemGuides sells refurbished modems and routers, including models from NETGEAR and ARRIS.

• Quentin Kaiser, October 16, 2026: One parser, two bugs
• WPSplinter documentation and affected device list
• PCWorld, October 20, 2026: Millions of routers have a 16-year-old flaw that nobody plans to fix
• Daily Security Review, October 19, 2026: Unpatched Broadcom WPS flaw lets nearby attackers root routers
• CISA Known Exploited Vulnerabilities catalog