AVGO · News · 20261021N

Wi-Fi Software Vulnerability

Broadcom Inc. · 2026-10-21 · Importance 40 · Surprise 42

A vulnerability called WPSplinter in Broadcom’s Wi-Fi software development kit reportedly remained unpatched for 16 years. The flaw could allow attackers within Wi-Fi range to execute arbitrary code or extract passwords without authentication. The report said potentially hundreds of millions of routers worldwide could be exposed. Broadcom reportedly issued an incomplete fix and left device manufacturers and internet service providers responsible for remediation.

Key facts

• A critical vulnerability named WPSplinter in Broadcom's Wi‑Fi software development kit has remained unpatched for 16 years. source
• The WPSplinter flaw exposes potentially hundreds of millions of routers worldwide to hijacking. source
• The WPSplinter flaw allows attackers within Wi‑Fi range to execute arbitrary code or extract passwords without authentication. source
• Broadcom knew about the WPSplinter issue since 2018, refused to assign a CVE number, and only issued an incomplete fix that shifted responsibility to device manufacturers and ISPs. source