Broadcom 802.11 SDK Detection Toolkit

This repository contains two ways to detect the presence of Broadcom's 802.11 implementation on a target router:

1. Statically using YARA rules on extracted firmware
2. Dynamically by running a fingerprinting script against a live access point

The list of affected devices is available at the end of this page. This list is not exhaustive. We expect the complete list to contains thousands of different devices, make and models.

Broadcom WPS Monitor YARA rules

broadcom_wps_monitor.yar contains three candidate detectors for ELF32 ARM and MIPS binaries:

• BRCM_WPS_Monitor_Generic_ELF identifies a generic Broadcom WPS Monitor binary from independent vendor and protocol strings.
• BRCM_WPS_Monitor_HAL_Config_ELF identifies the narrower HAL configuration event variant.
• VULN_BRCM_WPS_EAP_Fragment_Reassembly_ELF requires the generic component evidence plus an ARM or MIPS opcode shape associated with the vulnerable fragment-reassembly path.

These rules are triage aids. Compiler changes can evade opcode patterns, and a patched binary can retain strings or code bytes used by a candidate detector. Confirm findings against the integrated source or by manual review of the fragment-length validation and copy sink.

You can find binaries with this command:

yara -w -r broadcom_wps_monitor.yar extracted_firmware_dir

Broadcom SDK Fingerprinter

Make sure your interface supports monitor mode and enable monitor mode:

sudo ip link set dev wlp0s12u1 down
sudo iw dev wlp0s12u1 set monitor none
sudo ip link set dev wlp0s12u1 up

You should seem something like this on affected devices:

sudo uv run --with scapy broadcom_fingerprint.py --interface wlp0s12u1 --ssid VOO-111317
Scanning channels 1-13 for SSID 'VOO-111317' (sweep 1)...
SSID:       VOO-111317
BSSID:      20:0c:c8:16:76:dc
Channel:    1
Vendor:     Netgear
Model:      Netgear
Assessment: LIKELY_VULNERABLE
JSON:       /tmp/broadcom-fingerprint-20261014T203352.732742Z/result.json
PCAP:       /tmp/broadcom-fingerprint-20261014T203352.732742Z/traffic.pcap

sudo uv run --with scapy broadcom_fingerprint.py --interface wlp0s12u1 --ssid Orange-180cd
Scanning channels 1-13 for SSID 'Orange-180cd' (sweep 1)...
SSID:       Orange-180cd
BSSID:      08:6a:0a:f1:80:d1
Channel:    1
Vendor:     TCG300
Model:      TCG300
Assessment: LIKELY_VULNERABLE
JSON:       /tmp/broadcom-fingerprint-20261014T205813.695480Z/result.json
PCAP:       /tmp/broadcom-fingerprint-20261014T205813.695480Z/traffic.pcap

sudo uv run --with scapy broadcom_fingerprint.py --interface wlp0s12u1 --ssid WiFi-2.4-4B3C
Scanning channels 1-13 for SSID 'WiFi-2.4-4B3C' (sweep 1)...
SSID:       WiFi-2.4-4B3C
BSSID:      38:35:fb:13:4b:42
Channel:    1
Vendor:     SagemCom
Model:      SagemcomFast5336v_BBOX3
Assessment: LIKELY_VULNERABLE
JSON:       /tmp/broadcom-fingerprint-20261014T205852.234368Z/result.json
PCAP:       /tmp/broadcom-fingerprint-20261014T205852.234368Z/traffic.pcap

On patched devices you'll see:

sudo uv run --with scapy broadcom_fingerprint.py --interface wlp0s12u1 --ssid MY-AP
Scanning channels 1-13 for SSID 'MY-AP' (sweep 1)...
SSID:       MY-AP
BSSID:      38:35:fb:13:4b:42
Channel:    1
Vendor:     SagemCom
Model:      SagemcomFast5336v_BBOX3
Assessment: PATCHED_HOSTAPD
JSON:       /tmp/broadcom-fingerprint-20261014T205852.234368Z/result.json
PCAP:       /tmp/broadcom-fingerprint-20261014T205852.234368Z/traffic.pcap

If your device does not advertise WPS it's not affected and you'll see this:

sudo uv run --with scapy broadcom_fingerprint.py --interface wlx00c0ca588c7e --ssid MY-AP
Scanning channels 1-13 for SSID 'MY-AP' (sweep 1)...
SSID:       MY-AP
BSSID:      1c:0b:8b:xx:xx:xx
Channel:    6
Vendor:     Unknown
Model:      Unknown
Assessment: INCONCLUSIVE
JSON:       /tmp/broadcom-fingerprint-20261019T113912.161025Z/result.json
PCAP:       /tmp/broadcom-fingerprint-20261019T113912.161025Z/traffic.pcap
Warning: selected AP does not advertise WPS

The fingerprinting script relies on two things:

1. the presence of Broadcom proprietary information elements
2. an implementation quirk that can differentiate between Broadcom's wps_monitor and hostapd

The presence of Broadcom proprietary information element is not a sufficiently strong signal since it's sometimes added by Broadcom's Linux kernel module while the user space implementation is not from their SDK. We use that signal to check if it's Broadcom or not.

If it's a Broadcom AP, we send a zero-lenght fragmented frame to differentiate between Broadcom's wps_monitor and hostapd. hostapd sends an ACK while wps_monitor sends a NACK (in a nutshell).

If we have both signals (Broadcom IE + implementation quirk), we can assess with a rather high confidence level that you're affected.

Reporting Affected Devices

You can report affected devices by opening a Pull Request. In your PR, make sure to provide the vendor, product, version, and optionally the Internet Service Provider that deploys them. If you identified it statically, please provide a link to the firmware. If you identified it dynamically, please provide the PCAP generated by the fingerprinting script.

Affected Devices

THIS LIST IS NOT EXHAUSTIVE. YOU MAY BE AFFECTED EVEN IF YOUR DEVICE IS NOT IN THIS LIST.

The best way to verify that is to get your hands on the firmware, extract it, and run the YARA rule. If you don't have access to the firmware, you can run the fingerprinting script using a wireless interface in monitor mode.