16 Oct 2026
https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/
A vulnerability in Broadcom’s proprietary WPS implementation enables unauthenticated attackers within WiFi range to leak memory and achieve unauthenticated remote code execution on millions of routers. This post covers its discovery through agentic vulnerability research, exploitation across eCos and Linux platforms, its impact on the global router supply chain, and a disclosure process rather … interesting.
18 Jul 2026
https://quentinkaiser.be/security/2026/07/18/ia-assisted-vuln-research/
I gave an AI agent access to a cable modem, a serial console, Ghidra, and a custom GDB stub, then asked it to reverse the firmware and hunt for bugs. It re-discovered known vulnerabilities, found new ones, and wrote working exploits. This post covers the setup, what it managed to do on its own, and where I still had to step in. The real problem is that the same approach now works on millions of devices nobody plans to fix.
25 Apr 2021
https://quentinkaiser.be/security/2021/04/25/orange/
This report outlines vulnerabilities found in Askey TCG300 cable modems provided by Orange Belgium to its subscribers. The modems are vulnerable to authenticated and unauthenticated remote code execution through the web administration server. These vulnerabilities arise from memory corruptions due to insecure function calls when handling HTTP requests. By exploiting these vulnerabilities, an attacker can gain unauthorized access to Orange Belgium customers LAN, fully compromise the router, and l...