WPSplinter in France: scope of the Paris radio survey

One row in a conference slide can quickly become “Liveboxes can be hacked.” This row deserves a closer reading. On 16 October 2026, Quentin Kaiser published WPSplinter, his research into EAP-WPS fragment reassembly in Broadcom’s legacy WPS Monitor. In his Hexacon slides, a passive radio survey in Paris labels one Livebox 5 reference and two SFR NB6VAC revisions “Not Patched.” His published code-execution demonstrations, however, concern Belgian gateways. That gap between a French signal and a Belgian exploit is the useful question: what can we tell a subscriber in France, and what remains to be measured?

The discovery and the research are Kaiser’s. Our contribution is a technical reading of the French evidence as of 20 October 2026. We have neither reproduced the attack on a French gateway nor surveyed the national fleet.

The parser handles fragments before the Wi-Fi key

WPS tends to evoke the old PIN brute-force attack. That is not Kaiser’s finding. In the path he analyzed, the access point receives EAP-WPS fragments at a stage reachable over the air before the attacker knows the network key or completes WPS enrollment. WPS Monitor adds and copies those fragments without properly constraining the assembled length to the destination buffer. Kaiser studied both the eCos and Linux Broadcom implementations, then turned the resulting primitives into memory disclosure and code execution. His technical write-up and the project FAQ explain where the authentication boundary lies.

“Within radio range” matters just as much as “without the Wi-Fi password.” An attacker cannot trigger this parser from anywhere on the Internet; they must be able to exchange the relevant radio frames with the device. Conversely, changing the Wi-Fi password does not repair a parser reached before that password is checked. In an Orange Belgium ASKEY TCG3000 demonstration, Kaiser retrieves the PSK from NVRAM and then joins the network. On a Proximus BBOX3V+, he obtains a shell over 802.11 frames. Those are concrete results on particular firmware. Applying either outcome unchanged to Orange France or SFR would add a claim the demonstrations do not establish.

The patch history helps explain why the bug endured. Kaiser dates the old implementation to at least 2010, describes an incomplete 2018 fix, and says a newer Broadcom SDK later replaced it with hostapd. In a vendor response reproduced in his slides, Broadcom says it has offered software without this vulnerability for years. That does not tell us which manufacturer integrated it, let alone when an ISP pushed it to each gateway. A fix must cross the boundaries between SDK, OEM, customized firmware, and ISP rollout.

Geographic limits of the Paris survey

The “Passive War Driving in Paris” slide is more useful than an alarming headline. It labels Sagemcom Fast5656_OFR associated with a Livebox SSID and NB6VAC-FXC-r0/r1 associated with SFR as “Not Patched.” On the same slide, Sagemcom F5696b (Bbox), Fast5698_OFR, Fast5670_OFR, and a Sercomm repeater associated with Orange are “Patched.” That contrast alone shows why “Broadcom,” or even “Livebox,” is too broad a category: implementations differ.

The table provides no Paris sample size, firmware distribution, or representative selection of the French fleet. “Not Patched” is the survey’s classification; it is not an exploit recording for every unit bearing the model name. Kaiser’s detection repository lists Neuf NB6/NB6VAC deployed by SFR, but its version field is TODO. The public project page warns that hardware and firmware revisions can vary within one model. We therefore cannot turn those rows into a number of affected households or declare every NB6VAC exploitable.

How does the researcher relate a radio observation to a closed-source component? His tool combines proprietary Broadcom information elements in radio frames with a different response to a zero-length WPS fragment: hostapd and the old wps_monitor answer differently. A Broadcom element by itself is insufficient, as the repository says explicitly. Even the combined signal is a way to prioritize devices for examination, not proof of fragment-length validation in every firmware. The accompanying YARA rules for extracted images have similar limits: a rebuilt binary can escape a signature, while a fixed binary can retain bytes that match it. The decisive check is the reassembly path in the exact firmware. (Detection method and limits)

Kaiser also estimates roughly 850,000 potentially affected Proximus gateways, 500,000 VOO, and 210,000 Orange Belgium, using subscriber data and commercial statements; he calls his confidence medium. These are neither counted devices nor, plainly, French statistics. His public disclosure chronology records contact with Broadcom and Belgian organizations. The absence of French ISPs from that list does not prove that no other notification channel reached them. (Write-up and timeline)

Check firmware versions with the ISP

For a subscriber, the SSID and commercial name printed on a gateway are inadequate identifiers. The useful facts are the exact model, hardware revision, firmware version, and an OEM or ISP answer about the legacy WPS Monitor and the update addressing WPSplinter. An enterprise fleet can additionally review extracted firmware or use Kaiser’s tools to prioritize devices it is authorized to test. A fingerprint deserves confirmation; it cannot replace a version-specific fix statement.

Disabling WPS when it is unused is sensible surface reduction, but Kaiser’s FAQ warns that the UI toggle may leave the vulnerable parser active. Calling that checkbox a patch would mislead readers. Claiming there is no fixed software would also be misleading: Broadcom describes a newer, unaffected implementation, while its actual distribution to subscribers remains to be documented per device.

Media coverage has already aged on this distinction. The Hacker News on 19 October treated Telenet as possibly affected and described there being no patch to install; Kaiser’s 20 October update says Telenet has declared its fleet unaffected after checking it. ISP information can change within days. For France, what we need most are verifiable answers from Orange and SFR: which revisions, which firmware builds, when deployed, and what happens to the parser when WPS is disabled?

The Paris survey warrants a focused investigation of French references. It does not support “millions of compromised French gateways” or “RCE confirmed on every Livebox 5.” Kaiser has shown a serious vulnerability. The next unit of evidence for France should be the firmware of a particular French gateway, not an extrapolation from its logo.