Tag: Router Settings

That ‘WPS’ Button on Your Router Just Became a Giant Security Hole

Walk over to your Wi-Fi router and look at the back panel. Right next to the power cord and those blinking yellow Ethernet ports, you’ll probably spot a tiny plastic button labeled WPS.

Maybe you pressed it once four years ago to connect a wireless printer without typing your password on a tiny two-inch screen. Since then, you haven’t touched it. You probably figured that if nobody is physically pushing the button, it isn’t doing anything.

Bad news. It’s still listening. And right now, a newly uncovered flaw is letting attackers use that exact feature to walk straight into home routers from the street—no Wi-Fi password required.

What Is “WPSplinter” and Why Should You Care?

WPS stands for Wi-Fi Protected Setup. Hardware makers cooked it up back in the late 2000s so folks wouldn’t have to type a 20-character password using the up-and-down arrow keys on a cheap printer.

Even back then, IT people hated it. Standard WPS relied on an 8-digit PIN that a laptop could guess in a few hours.

This week, security researcher Quentin Kaiser dropped something much worse at the Hexacon security conference. He found a critical memory bug—nicknamed WPSplinter—baked into the Broadcom Wi-Fi chips sitting inside millions of home routers and ISP gateway boxes from brands like Netgear, TP-Link, Technicolor, and ZTE.

Here is why this one stings:

  • An attacker doesn’t need to know your Wi-Fi password.
  • They don’t need you to click a bad link.
  • They just need to be within wireless range—sitting in a parked car down the block or an apartment next door—and send a specially mangled WPS request over the air.

Because of a 15-year-old coding mistake in how the chip glues those wireless messages back together, the router chokes and hands the attacker full control. Within seconds, they can pull your saved Wi-Fi password straight out of the router’s memory in plain text.

3 Fixes to Lock Down Your Router Today

Waiting around for your internet provider to push an automatic patch for a 2010 chip bug is a losing bet. Take five minutes and close the hole yourself.

Fix 1: Turn Off WPS in Your Router Settings

Unplugging the button physically doesn’t work—you have to switch the feature off inside the router’s brain.

  • Open a browser on your computer or phone while connected to your home Wi-Fi.
  • Type your router’s address into the top bar—usually 192.168.1.1, 192.168.0.1, or 10.0.0.1—and hit Enter. (If you aren’t sure, flip your router over and read the sticker on the bottom; it prints the exact login address and admin password right there).
  • Log in and head to Wireless, Advanced Wireless, or Wi-Fi Settings.
  • Look for WPS (Wi-Fi Protected Setup) and flip the toggle to Disabled or Off. If you see a box for WPS PIN, uncheck that too, then hit Save.

Fix 2: Force a Firmware Check (Or Retire That Old ISP Box)

Most routers only check for security updates when they reboot, and some older units stop checking altogether unless you poke them.

  • While you’re still logged into that router menu (or inside your Eero, Nest, TP-Link Tether, or Netgear Nighthawk phone app), go to System or Administration -> Firmware Update.
  • Click Check for Updates and install anything waiting.
  • Here is my neighborly rule of thumb: if your router or cable gateway is more than five years old and the last firmware date says 2021 or 2022, stop trusting it. Call your ISP and demand a current Wi-Fi 6E or Wi-Fi 7 gateway—they almost always swap out aging rental boxes for free when you mention a security flaw.

Fix 3: Kick Your Smart Gadgets Onto the Guest Network

Your router is the front door to everything in your house. If a cheap $12 smart plug or an older router setting gets compromised, you don’t want it sharing a room with the laptop you use for online banking.

  • Open your router app or web page and turn on the Guest Network.
  • Make sure the option called Allow guests to see each other and access my local network is switched Off.
  • Connect your smart TVs, robot vacuums, and Wi-Fi lightbulbs to that Guest Wi-Fi. Keep your phones and work laptops on the main network.

The 60-Second Check

Don’t want to dig through router menus right this second? Do a quick visual check right now:

  • Walk over to your router and look at the row of glowing indicator lights on the front or top.
  • Look for the symbol with two curved arrows forming a circle (or the letters WPS).
  • If that light is glowing solid green, blue, or blinking amber, WPS is active on your box right now. Grab your phone, open your router app, and shut it off before dinner.