Is the Hub Two affected by the Broadcom WPS Wi-Fi flaw?

[#1]

This month, the security researcher Quentin Kaiser published details of a flaw in the WPS code in Broadcom's Wi-Fi software. Someone within Wi-Fi range can use it to take over a router as root without knowing the Wi-Fi password. Broadcom has not issued a CVE or a patch, and has told manufacturers to move to hostapd instead. The affected chips include Linux-based Broadcom gateway chips such as BCM63xx, which I believe includes the BCM63138 in the Hub Two.

My Hub Two is on firmware v0.11.01.11071-PN. I have turned WPS off. Could Plusnet please confirm:

1. Whether the Hub Two, and any other Plusnet hubs, use the affected Broadcom Wi-Fi software.
2. Whether turning WPS off fully protects against this flaw, or whether the vulnerable code still runs.
3. Whether a firmware update is planned, and roughly when.
4. If no fix is planned, whether affected hubs will be replaced.

Background: https://www.theregister.com/networks/2026/10/19/broadcom-wi-fi-bug-turns-sweet-16-still-lets-strange...

Thanks.

Heather Herbert

[#2]

We always keep WPS disabled regardless of the chipsets in a Wi-Fi Hub/Router or Access Point.

[#3]

This is regurgitation of old news.  This was not released by Kaiser this month.  The Register is trying to be newsworthy / trendy by picking over old news.

Whatever the detail of the issue, the attack vector is arguably very narrow - it could happen only when you press the WPS button ... if someone is sat nearby in a van waiting for you to do so.  All too often the "fuss" made over "security" concerns is not proportionate to the likelihood of the vulnerability being exposed.

If WPS is not enabled or the WPS button is not pressed, then the bad guy parked in a van in the street waiting for that one-a-year push of the WPS button ... is going to be waiting in vain.