A few days ago, while analyzing Broadcom firmware, researcher Quentin Kaiser discovered a critical vulnerability in a WiFi chip that is present in numerous routers installed by different operators in different countries.
Among the different models affected in Spain, there are teams from Movistar, O2, Orange, Jazztel and Simyo. They are not the latest routers, but they are still present in many Spanish homes, which has raised some concerns among many users.
We spoke to Movistar and Orange to find out the extent of this security flaw and what we should do if one of our routers is compromised. The two organizations are already working to implement the necessary safeguards as soon as possible.
Photo: Movistar
A security flaw in the software. Using an AI model specialized in cybersecurity, Quentin Kaiser analyzed Broadcom’s firmware and found a security flaw in it. A WiFi chip from an American manufacturer that is very common in home routers.
Explained in simple terms, this vulnerability allows access original And run the code with administrator privileges to copy the WiFi network key directly from RAM. All this remotely and without the need for authentication, just by being in a place close to the equipment.
No router is compromised. Quentin Kaiser himself explained that this vulnerability has been present in Broadcom chipset equipment since 2010, which is why it affects routers installed over the years by different operators in different countries.
The good news is that, in many cases, they have already been replaced by more modern models; The bad news is that, among the affected models, there are popular devices like the original Movistar HGU router and some orange models. On the list of compromised devices, there are four routers that have served or continue to serve many homes:
- ZTE F680 v4: Installed by Jazztel, MásMóvil and Yoigo.
- Comtrend VG8050: Installed by Movistar At the beginning of fiber deployment.
- Sagecom FAST 5656: Installed Livebox Fiber Router Kamala, Jazztel and Simeo.
- MitraStar GPT-2541GNAC and Askey RTF3505VW: Installed by HGU Router Movistar and O2.
Photo: Kamala
If you have one of those models, don’t worry.. Both Telefonica and Orange confirmed to Xataka that they are aware of the vulnerability and are already working to remedy it. Moreover, they assure that none of the parties have compromised till date due to this failure.
Orange has already started deploying the necessary security updates to fix this, updates that will automatically reach its customers, without them having to do anything:
“In the case of Orange, Livebox routers, Orange has been made aware of potential vulnerabilities affecting some components used in equipment deployed by telecommunications operators. Following their discovery, our teams have begun risk assessments on our routers and, in collaboration with our suppliers, have initiated the deployment of the necessary measures.
To date, Orange has not identified any cases where these vulnerabilities have been used to attack its customers With regard to updates, clients do not need to take any action; Security updates are automatically deployed to connected devices.”
Telefonica, for its part, explained to us that, since this vulnerability was discovered at manufacturer Broadcom, they are “directly communicating with suppliers to conduct final tests on our managed equipment.” Through its community, Movistar also confirmed that its “specialized teams are already working in this situation and implementing the necessary security measures”, so its customers don’t have to do anything either:
“At this point, there is no need to change the router configuration or replace the equipment, since the necessary security and correction measures are managed centrally by the responsible parties. If it is necessary to take additional measures or transfer new recommendations, it will be communicated through active official channels.”
Cover image Movistar / Orange / Jazztel (AI Generated Montage)
In Xataka | Automatically switching internet companies at your home is a hassle. It turns out that you need to ‘hack’ the new router
