https://community.plus.net/t5/My-Router/Is-the-Hub-Two-affected-by-the-Broadcom-WPS-Wi-Fi-flaw/m-p/2063374#M45416 <P>This is regurgitation of old news.&nbsp; This was not released by Kaiser this month.&nbsp; The Register is trying to be newsworthy / trendy by picking over old news.</P> <P>Whatever the detail of the issue, the attack vector is arguably very narrow - it could happen only when you press the WPS button ... if someone is sat nearby in a van waiting for you to do so.&nbsp; All too often the "fuss" made over "security" concerns is not proportionate to the likelihood of the vulnerability being exposed.</P> <P>If WPS is not enabled or the WPS button is not pressed, then the bad guy parked in a van in the street waiting for that one-a-year push of the WPS button ... is going to be waiting in vain.</P> Mon, 26 Oct 2026 18:18:07 GMT Townman 2026-10-26T18:18:07Z https://community.plus.net/t5/My-Router/Is-the-Hub-Two-affected-by-the-Broadcom-WPS-Wi-Fi-flaw/m-p/2063335#M45414 <P>This month, the security researcher Quentin Kaiser published details of a flaw in the WPS code in Broadcom's Wi-Fi software. Someone within Wi-Fi range can use it to take over a router as root without knowing the Wi-Fi password. Broadcom has not issued a CVE or a patch, and has told manufacturers to move to hostapd instead. The affected chips include Linux-based Broadcom gateway chips such as BCM63xx, which I believe includes the BCM63138 in the Hub Two.<BR /><BR />My Hub Two is on firmware v0.11.01.11071-PN. I have turned WPS off. Could Plusnet please confirm:<BR /><BR />1. Whether the Hub Two, and any other Plusnet hubs, use the affected Broadcom Wi-Fi software.<BR />2. Whether turning WPS off fully protects against this flaw, or whether the vulnerable code still runs.<BR />3. Whether a firmware update is planned, and roughly when.<BR />4. If no fix is planned, whether affected hubs will be replaced.<BR /><BR />Background: <A href="https://www.theregister.com/networks/2026/10/19/broadcom-wi-fi-bug-turns-sweet-16-still-lets-strangers-hijack-your-router/5303771" target="_blank">https://www.theregister.com/networks/2026/10/19/broadcom-wi-fi-bug-turns-sweet-16-still-lets-strangers-hijack-your-router/5303771</A><BR /><BR />Thanks.</P><P>Heather Herbert</P> Mon, 26 Oct 2026 16:32:56 GMT https://community.plus.net/t5/My-Router/Is-the-Hub-Two-affected-by-the-Broadcom-WPS-Wi-Fi-flaw/m-p/2063335#M45414 Heather_H 2026-10-26T16:32:56Z https://community.plus.net/t5/My-Router/Is-the-Hub-Two-affected-by-the-Broadcom-WPS-Wi-Fi-flaw/m-p/2063355#M45415 <P>We always keep WPS disabled regardless of the chipsets in a Wi-Fi Hub/Router or Access Point.</P> Mon, 26 Oct 2026 17:06:33 GMT https://community.plus.net/t5/My-Router/Is-the-Hub-Two-affected-by-the-Broadcom-WPS-Wi-Fi-flaw/m-p/2063355#M45415 PhilipHeyes 2026-10-26T17:06:33Z https://community.plus.net/t5/My-Router/Is-the-Hub-Two-affected-by-the-Broadcom-WPS-Wi-Fi-flaw/m-p/2063374#M45416 <P>This is regurgitation of old news.&nbsp; This was not released by Kaiser this month.&nbsp; The Register is trying to be newsworthy / trendy by picking over old news.</P> <P>Whatever the detail of the issue, the attack vector is arguably very narrow - it could happen only when you press the WPS button ... if someone is sat nearby in a van waiting for you to do so.&nbsp; All too often the "fuss" made over "security" concerns is not proportionate to the likelihood of the vulnerability being exposed.</P> <P>If WPS is not enabled or the WPS button is not pressed, then the bad guy parked in a van in the street waiting for that one-a-year push of the WPS button ... is going to be waiting in vain.</P> Mon, 26 Oct 2026 18:18:07 GMT https://community.plus.net/t5/My-Router/Is-the-Hub-Two-affected-by-the-Broadcom-WPS-Wi-Fi-flaw/m-p/2063374#M45416 Townman 2026-10-26T18:18:07Z