WPSplinter: NETGEAR requests PoC; working exploit hits end-of-support ASUS
WPSplinter is a 16-year-old flaw in the Broadcom Wi-Fi stack that lets anyone in Wi-Fi range hijack a router. NETGEAR asked researcher Quentin Kaiser for his proof of concept and reproduction steps to validate the flaw, and his list names more than a dozen NETGEAR models. Kaiser says someone built a working exploit for the ASUS RT-AC66U running its latest firmware from March 2025; the device is end-of-support, so no fix is expected.
What happened
WPSplinter, a 16-year-old flaw in the Broadcom Wi-Fi stack, lets anyone in Wi-Fi range hijack a router. NETGEAR emailed researcher Quentin Kaiser asking for his proof of concept and reproduction steps to independently validate the vulnerability. Kaiser says someone already built a working exploit for the ASUS RT-AC66U running its latest firmware, from March 2025.
Why it matters
The attack only requires proximity to the Wi-Fi signal, with no remote access needed. The researcher's list names more than a dozen NETGEAR models, and the ASUS RT-AC66U is end-of-support with no fix expected. A hijacked router compromises the whole network behind it.
What to do
Check the company's router inventory against the researcher's affected device list. Plan replacement of end-of-support models such as the ASUS RT-AC66U. Track NETGEAR advisories while the company validates the flaw.
For the technical team
- Affected
- Roteadores Wi-Fi com a falha WPSplinter na pilha Broadcom, incluindo o ASUS RT-AC66U (fora de suporte) e mais de uma dúzia de modelos NETGEAR · Routers with the affected Broadcom Wi-Fi stack. Researcher Quentin Kaiser's list names more than a dozen NETGEAR models plus the ASUS RT-AC66U, including on its latest firmware, from March 2025.
- Exploitation
- No in-the-wild exploitation reported in the sources. Researcher Quentin Kaiser says someone built a working exploit for the ASUS RT-AC66U on the March 2025 firmware. The exploit was not published; Kaiser released only a detection tool.
- Fix
- No available fix cited. The ASUS RT-AC66U is end-of-support (EoS); the researcher calls it a 'forever day', with no fix expected. NETGEAR is still validating the flaw and mentioned no patch.
- Vector
- Broadcom Wi-Fi stack; WPSplinter flaw, present for 16 years. Exploitation condition: the attacker only needs to be within Wi-Fi range of the router.
- More details
- NETGEAR emailed Kaiser asking for the PoC and reproduction steps to 'independently validate the vulnerability'. Kaiser told the vendor to run his detection tool on its own firmware. Quentin Kaiser is the researcher behind WPSplinter.
Timeline
NETGEAR asked the researcher for his PoC and reproduction steps to independently validate the flaw; the affected-device list names more than a dozen NETGEAR models.
Incident opened.
Sources 2 sources
- @qkaiser @qkaiser
- @IntCyberDigest @IntCyberDigest
