一名安全研究员发现，博通（Broadcom）Wi-Fi软件中存在一个长达16年的安全漏洞，攻击者无需知道网络密码即可劫持数百万台路由器，尽管该芯片制造商据称早在2018年就已知晓该问题。安全研究员昆廷·凯撒（Quentin Kaiser）披露了这一漏洞，命名为“WPSplinter”，揭示了博通专有Wi-Fi实现中存在的两个漏洞，这些漏洞可追溯至至少2010年。
A 16-year-old security flaw in Broadcom's Wi-Fi software could let attackers hijack millions of routers without knowing the network password, even though the chipmaker reportedly knew about the problem since 2018. Security researcher Quentin Kaiser disclosed the vulnerability, dubbed "WPSplinter," revealing two bugs in Broadcom's proprietary Wi-Fi implementation that date back to at least 2010.
八年后才出现的尝试性修复，但凯撒称其未能完全解决问题。该漏洞存在于博通对Wi-Fi保护设置（WPS）的处理过程中，WPS是一项功能，允许用户无需手动输入密码即可将设备连接到无线网络。凯撒发现，精心构造的WPS消息可能导致路由器内存损坏，使得处于Wi-Fi覆盖范围内的攻击者能够在设备上运行自己的代码。
An attempted fix arrived eight years later, but Kaiser claims it didn't fully resolve the problem. The bugs lie in Broadcom's handling of Wi-Fi Protected Setup (WPS), the feature that lets users connect devices to a wireless network without manually entering a password. Kaiser found that specially crafted WPS messages could corrupt the router's memory, allowing someone within Wi-Fi range to run their own code on the device.
攻击者不需要知道Wi-Fi密码，路由器的所有者也无需采取任何行动。凯撒演示了针对比利时互联网服务提供商Proximus和Orange提供的路由器的有效利用方式。在对ASKEY TCG3000网关的一次攻击中，他在设备上运行代码，从内存中提取了Wi-Fi密码，并通过空中传输将其发送回去。随后，他使用被窃取的凭证加入了该网络。
They wouldn't need the Wi-Fi password, and the router's owner wouldn't have to do a thing. Kaiser demonstrated working exploits against routers supplied by Belgian internet providers Proximus and Orange. In one attack against an ASKEY TCG3000 gateway, he ran code on the device, pulled its Wi-Fi password from memory, and sent it back over the air. He then used the stolen credentials to join the network.
他还在VOO提供的Netgear和Technicolor路由器中发现了该漏洞。他估计，大约85万台Proximus网关可能受到影响，此外VOO约有50万台，Orange Belgium约有21万台。这使得仅在比利时就可能有156万台路由器受到威胁，尽管凯撒承认这些数字是粗略估计。然而，该问题不太可能止步于比利时边界。博通的Wi-Fi技术被数十家制造商用于数百种产品之中，意味着全球受影响设备的数量可能要高得多。
He also found the flaw in Netgear and Technicolor routers supplied by VOO. He estimates that around 850,000 Proximus gateways could be affected, along with 500,000 at VOO and 210,000 at Orange Belgium. That puts the potential total at 1.56 million routers in Belgium alone, although Kaiser admits the figures are rough estimates. However, the problem is unlikely to stop at the Belgian border. Broadcom's Wi-Fi technology is used by dozens of manufacturers across hundreds of products, meaning the number of affected devices worldwide could be considerably higher.
根据凯撒的说法，该芯片制造商早在2018年就已知晓该漏洞，并发布了部分修复方案，但未公开披露该问题。
According to Kaiser, the chipmaker knew about the vulnerability back in 2018 and released a partial fix without publicly disclosing the problem.
随后，它建议制造商摆脱其专有实现，改用开源的 hostapd 软件。运行博通较旧的基于 eCos 的芯片的路由器所有者，包括 BCM3380、BCM3383 和 BCM33834，处于特别严峻的境地。凯撒称该漏洞为“永恒日”，意味着这些设备可能永远无法获得修复。使用基于 Linux 的 BCM3390、BCM65xx 和 BCM68xx 芯片的路由器也不一定能幸免，除非其制造商切换到 hostapd。
It subsequently recommended that manufacturers move away from its proprietary implementation and use the open-source hostapd software instead. Owners of routers running Broadcom's older eCos-based chips, including the BCM3380, BCM3383, and BCM33834, are in a particularly grim position. Kaiser calls the flaw a "forever day," meaning those devices may never get a fix. Routers using Linux-based BCM3390, BCM65xx, and BCM68xx chips aren't necessarily off the hook either, unless their manufacturers switch to hostapd.
这使得一些较旧的路由器没有明显的修复途径，而另一些则依赖于制造商更新可能已停止支持多年的软件。凯撒于 7 月 18 日首次向博通报告了这些漏洞，随后于 7 月 27 日提交了第二份报告，给予公司和受影响的供应商 90 天的时间，随后才公开披露。博通于 7 月 28 日作出回应，称补丁已可用，并建议他直接联系受影响的制造商。
That leaves some older routers with no obvious route to a fix, while others depend on their manufacturers updating software that may be years out of support. Kaiser first reported the vulnerabilities to Broadcom on July 18, followed by a second report on July 27, giving the company and affected vendors 90 days before public disclosure. Broadcom responded on July 28 to say a patch was available and advised him to contact affected manufacturers directly.
然而，第二天，该公司却拒绝分配 CVE 标识符，也未向他提供其声称通过客户门户发送给制造商的通知副本。凯撒还联系了 Proximus，试图联系比利时奥兰治和 VOO，并将他的发现提交给比利时国家网络安全当局。随后，他向 CERT/CC 提交了案例，该机构于 8 月 4 日结案，因为博通本身就是 CVE 编号授权机构，且已拒绝对此漏洞进行编号。
The following day, however, the company declined to assign a CVE identifier or provide him with a copy of the notification it said it had sent to manufacturers through its customer portal. Kaiser also contacted Proximus, attempted to reach Orange Belgium and VOO, and passed his findings to Belgium's national cybersecurity authorities. He subsequently opened a case with CERT/CC, which closed it on August 4 because Broadcom was itself a CVE Numbering Authority and had declined to the vulnerability.
到 10 月 15 日，即他演示前一天，凯撒表示他所识别的受影响设备中，尚未有一台获得补丁。凯撒尚未报告野外攻击的证据，但恶意利用的潜在风险相当大。有人停在住宅或办公室外，可能利用易受攻击的路由器窃取网络凭证，或利用其访问权限干扰网络流量。凯撒还称赞 AI 加速了调查进程。
By October 15, a day before his presentation, Kaiser said none of the affected devices he had identified had received a patch. Kaiser hasn't reported evidence of attacks in the wild, but the potential for mischief is considerable. Someone parked outside a home or office could potentially compromise a vulnerable router, steal network credentials, or use their access to interfere with traffic. Kaiser also credited AI with speeding up the investigation.
他认为这项工作通常需要几个月才能完成，但在前沿模型的帮助下，他用不到一周的时间就完成了。®
He reckons the work would ordinarily have taken him months, but with the help of frontier models, he finished it in less than a week. ®