---
title: Tip: check your access-point inventory against Kaiser's Broadcom WPS list, especially old Cisco RV/WAP small-business gear | ctxsec
url: https://ctxsec.com/items/tip-broadcom-wps-inventory
description: ""
status: "how-to"
published: 2026-10-17
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-broadcom-wps-inventory.md)

how-to

2026-10-17

### Tip: check your access-point inventory against Kaiser's Broadcom WPS list, especially old Cisco RV/WAP small-business gear

There's no CVE, so scanners and vendor feeds won't flag this Broadcom WPS bug. Compare your inventory with the affected-device table in Kaiser's broadcom-wps repo, which marks Cisco RV110W, RV130W, RV215W, RV340W and WAP121/125/150/361/371/571/571E/581 as confirmed, alongside ISP gateways from Proximus, VOO, Orange Belgium, KPN, Movistar and SFR. For firmware you've extracted, run the repo's YARA rules (`yara -w -r broadcom_wps_monitor.yar extracted_firmware_dir`); Kaiser notes they are triage aids, not proof. For live access points, his scapy fingerprinting script needs a Wi-Fi card in monitor mode, so only point it at networks you own or are authorized to test. Where a device is listed and the vendor has no fix, plan to replace it or move Wi-Fi to hardware you control. For ISP gateways, ask the ISP about a fix or bridge mode. The sources don't say whether turning WPS off in the admin UI is enough, so don't count on that alone.

Sources: [qkaiser/broadcom-wps (device list, YARA, fingerprinter)](https://github.com/qkaiser/broadcom-wps) · [Quentin Kaiser write-up](https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/)