Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root without a network password or a pairing step. The disclosed flaw remains unpatched. An affected router can therefore keep providing connectivity while someone nearby has a route to administrative control.

The owner has no update to install. Changing the network password does not block the access described in the report. The attacker does not need to join.

That makes patch availability consequential before anyone reaches a maintenance window. Microsoft has separately confirmed that this month's Windows Server security updates cause Exchange sign-in and mail delivery problems on some systems. There, an administrator has an update whose installation can disrupt service. For the affected Broadcom router, the reported fix is still missing.

Radio range limits who can attempt this attack. It also puts the relevant boundary outside the list of devices authorised to use the network. A strong password can remain entirely secret throughout the compromise.

Withdrawing an affected router from service removes that route to root access. Until a patch arrives or a replacement takes over, it also removes the connectivity the owner bought it to provide.