The Broadcom Wi-Fi flaw that sat in router code for 16 years isn’t only a Belgian problem. The researcher who disclosed it has now flagged gateways from AT&T, CenturyLink, Frontier and Comcast’s Xfinity, based on scans of their firmware.

None of those US models has been shown to be hacked, and no attacks in the wild have been confirmed. The catch is that the fix depends on your internet provider or router maker. Broadcom has also declined to issue the tracking number that usually pushes companies to patch.

A Belgian demo, then a list that kept growing

Quentin Kaiser, a Belgian security researcher, presented the bug at the Hexacon conference in Paris on October 16. He published a long write-up on his blog the same day. The bug sits in Broadcom’s code for Wi-Fi Protected Setup, or WPS. That’s the feature that lets a device join a network with a button press instead of a password.

Say Goodbye to Debt and Become Rich, Just Carry Them in Your Wallet

say goodbye to debt and become rich, just carry them in your wallet...

October 24, 2026

1:24 am

Doctor: If You Have Nail Fungus, Do This Immediately

doctor: if you have nail fungus, do this immediately...

October 24, 2026

1:26 am

4 Signs Telling That Parasites Are Living Inside Your Body

4 signs telling that parasites are living inside your body...

October 24, 2026

1:10 am

Varicose Veins and Blood Clots Will Disappear Very Quickly ! at Home!

varicose veins and blood clots will disappear very quickly ! at home!...

October 24, 2026

1:05 am

Kaiser writes that the code has been in Broadcom’s software kit “since at least 2010.” Someone within Wi-Fi range doesn’t need your network password to reach it, he says. He showed it working on gateways from three Belgian providers: Proximus, VOO and Orange.

In one demo he pulled the saved Wi-Fi password off an Orange Belgium box. In another he took control of a Proximus gateway.

His rough estimate for Belgium is about 1.56 million affected gateways, a div he holds with “medium confidence.” Early coverage, including Cyber Security News, centred on those Belgian devices. But Kaiser’s detection toolkit on GitHub now lists about 260 entries from 29 manufacturers. It warns that the list “is not exhaustive.”

My weight was 198 lbs, and now it’s 128 lbs! My diet is simple. 1/2 Cup Of This (Before Bed)

my weight was 198 lbs, and now it’s 128 lbs! my diet is simple. 1/2 cup of this (before bed)...

October 24, 2026

1:15 am

Knee & Joint Pain Will Go Away if You Do This Every Morning!

knee & joint pain will go away if you do this every morning!...

October 24, 2026

1:24 am

Salvation From Baldness Has Been Found! (Do This Before Bed)

salvation from baldness has been found! (do this before bed)...

October 24, 2026

1:02 am

This product is putting plastic surgeons out of work

this product is putting plastic surgeons out of work...

October 24, 2026

1:29 am

The US gateways on Kaiser’s list

We went through that list line by line on October 23. Nineteen entries name a US internet provider. Kaiser added most of them on October 22 and 23, after running his detection rules against firmware files. Several of those files came from the providers’ own support pages.

The list also includes gear sold in the US without a provider attached. It names North American versions of two older Netgear modem-routers, the DGND3700v2 and DGND4000. TP-Link’s Archer C3150 V2 with US firmware is there too, along with several Cisco small-business routers.

This is the US answer that early coverage missed, and it needs a careful reading. A firmware scan is a strong signal, not a demonstration. Kaiser calls his scanning rules “triage aids” and warns that a patched file can still trip them. The list also can’t tell you which firmware your own gateway runs today.

If You Find Moles or Skin Tags on Your Body, Read About This Remedy

if you find moles or skin tags on your body, read about this remedy...

October 24, 2026

1:10 am

This is a sign! Money is in sight! Read this and get rich.

this is a sign! money is in sight! read this and get rich....

October 24, 2026

1:17 am

Doctor: If You Have Nail Fungus, Do This Immediately

doctor: if you have nail fungus, do this immediately...

October 24, 2026

1:02 am

This Simple Trick Removes All Parasites From Your Body!

this simple trick removes all parasites from your body!...

October 24, 2026

1:03 am

So here’s the fair reading. These models shipped Broadcom’s vulnerable code at some point, and their providers now owe customers a clear answer.

Broadcom says a fix exists, but it hasn’t reached homes

Kaiser reported the bug to Broadcom on July 18 and July 27, his disclosure timeline shows. On July 28 Broadcom told him a patch was available and that device makers should contact the company. It then refused to register a CVE, the standard ID that security teams use to track fixes.

That refusal had a knock-on effect. Kaiser opened a case with the CERT Coordination Center on August 4, and it closed the same day. Broadcom is itself a CVE numbering authority, and it hadn’t assigned one.

America is in Shock! It Helps to Get Rid of Varicose Veins. Do It at Night

america is in shock! it helps to get rid of varicose veins. do it at night...

October 24, 2026

1:08 am

I weighed 332 lbs, and now 109! My diet is very simple trick. 1/2 Cup Of This (Before Bed)

i weighed 332 lbs, and now 109! my diet is very simple trick. 1/2 cup of this (before bed)...

October 24, 2026

1:25 am

People From America Those With Knee And Hip Pain Should Read This!

people from america those with knee and hip pain should read this!...

October 24, 2026

1:07 am

Your hair will grow by leaps and bounds. You only need 1 product

your hair will grow by leaps and bounds. you only need 1 product...

October 24, 2026

1:24 am

Broadcom moved away from the old WPS code in 2018, according to Kaiser’s public FAQ page. It reportedly declined a CVE because the software is outside its support window. We found no public Broadcom statement or advisory. TechSpot and The Hacker News also paraphrased its position rather than quoting it.

Kaiser calls the oldest affected chips a “definitive forever day,” meaning he expects no fix for them.

The pattern looks a lot like the PHP2Shell flaw we explained this week. The company that wrote the code says a fix exists, and someone else has to ship it. For routers, that’s your provider or the brand on the box, and many of the listed models are years old.

Do this twice a day, and everyone will think you have Botox!

do this twice a day, and everyone will think you have botox!...

October 24, 2026

1:03 am

If You Find Moles or Skin Tags on Your Body, Read About This Remedy

if you find moles or skin tags on your body, read about this remedy...

October 24, 2026

1:19 am

Your financial miracle starts here! Find out how

your financial miracle starts here! find out how...

October 24, 2026

1:14 am

Doctor: If You Have Nail Fungus, Do This Immediately

doctor: if you have nail fungus, do this immediately...

October 24, 2026

1:19 am

Kaiser says he knows of no real-world attacks using the flaw, The Hacker News reported. A translated PCWorld article said it was being exploited, but we found no evidence of that anywhere else.

What to do with your router tonight

Your router guards every device behind it, including smart TVs like the LG sets caught scanning home networks. These steps apply whether or not your model is on the list:

1. Find your model name on the label, usually on the back or bottom. AT&T’s BGW210 also has it printed on the front. Compare it with Kaiser’s list, but a missing model isn’t proof of safety.
2. Turn off WPS in the router’s admin settings. CISA’s home network security guide already says to “Disable Wi-Fi Protected Setup (WPS).” Treat it as a stopgap. Kaiser warns that a settings toggle “may not remove or fully disable the vulnerable parser.”
3. Update the firmware. CISA says to check the maker’s website for the latest version, and some routers update themselves. Kaiser’s FAQ suggests asking your provider whether an update fixes this specific issue.
4. If no fix comes, TechSpot suggests turning off the gateway’s Wi-Fi and switching it to bridge mode. You’d then run your own up-to-date router behind it.

Changing your Wi-Fi password won’t help here, TechSpot notes, because the flaw is reachable before a device logs in. Older home gear matters beyond your own house, too, as our explainer on the FBI’s botnet cleanup showed.

Belgium moved within days, but US providers haven’t spoken

Switching WPS off seems to blunt the risk. Kaiser’s toolkit reports that a router not advertising WPS isn’t affected, and that’s the fix Belgium’s biggest provider chose first. Proximus turned off WPS across its whole fleet within about 24 hours, Kaiser wrote on October 20. It plans full patching in the coming weeks.

Orange Belgium is looking at doing the same, he wrote, while Telenet checked its fleet and isn’t affected. We found no public statement on the flaw from AT&T, CenturyLink, Frontier or Comcast as of October 24. AT&T’s BGW210 support page still explains the gateway’s WPS light, with no mention of the issue.

Kaiser is still adding devices through GitHub, and anyone can submit a model with firmware evidence. The next test is whether the four US providers publish firmware notes for the listed models. They could also follow Proximus and switch WPS off remotely.