CVE-2017-9417
📋 TL;DR
CVE-2017-9417 (Broadpwn) is a critical remote code execution vulnerability in Broadcom BCM43xx Wi-Fi chips that allows attackers to execute arbitrary code on affected devices without user interaction. This affects millions of Android and iOS devices, routers, and other IoT devices using these chips. Attackers can exploit this vulnerability when the device's Wi-Fi is enabled, even if not connected to a network.
💻 Affected Systems
- Android devices
- iOS devices
- Routers with Broadcom BCM43xx chips
- IoT devices with affected chips
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing persistent malware installation, data theft, and device takeover as part of botnets.
Likely Case
Remote code execution leading to data exfiltration, surveillance, or device bricking in targeted attacks.
If Mitigated
Limited impact with proper network segmentation and updated firmware, though risk remains for unpatched devices.
🎯 Exploit Status
Exploit code was publicly released and weaponized in the wild. Attack requires proximity but no user interaction.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Varies by vendor - Android July 2017 security patch, iOS 10.3.3, router firmware updates from 2017
Vendor Advisory: https://source.android.com/security/bulletin/2017-07-01
Restart Required: Yes
Instructions:
1. Apply latest firmware/OS updates from device manufacturer. 2. For Android: Install July 2017 or later security patch. 3. For iOS: Update to iOS 10.3.3 or later. 4. For routers: Update to latest firmware from vendor.
🔧 Temporary Workarounds
Disable Wi-Fi when not needed
allTurn off Wi-Fi radio to prevent exploitation
# Android: adb shell svc wifi disable
# iOS: Settings > Wi-Fi > Off
# Linux: sudo nmcli radio wifi off
Network segmentation
allIsolate vulnerable devices from critical networks
🧯 If You Can't Patch
- Replace affected hardware with updated chipsets
- Implement strict network access controls and monitor for suspicious Wi-Fi activity
🔍 How to Verify
Check if Vulnerable:
Check device model and firmware version against vendor advisories. For Android: Settings > About phone > Android security patch level (should be July 2017 or later).Check Version:
# Android: getprop ro.build.version.security_patch
# iOS: Settings > General > About > Version
# Linux routers: cat /proc/versionVerify Fix Applied:
Verify firmware version is patched per vendor recommendations and test Wi-Fi functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual Wi-Fi driver crashes
- Kernel panics related to networking
- Unexpected firmware reloads
Network Indicators:
- Malformed Wi-Fi frames targeting BCM43xx chips
- Unusual broadcast/multicast traffic from devices
SIEM Query:
source="*kernel*" AND ("BCM43xx" OR "broadcom" OR "wifi") AND ("crash" OR "panic" OR "exception")🔗 References
- http://seclists.org/fulldisclosure/2019/May/24
- http://www.securityfocus.com/bid/99482
- http://www.securitytracker.com/id/1038950
- http://www.securitytracker.com/id/1039330
- https://lists.debian.org/debian-lts-announce/2018/11/msg00015.html
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-9417
- https://seclists.org/bugtraq/2019/May/30
- https://source.android.com/security/bulletin/2017-07-01
- https://support.apple.com/kb/HT210121
- https://www.blackhat.com/us-17/briefings.html#broadpwn-remotely-compromising-android-and-ios-via-a-bug-in-broadcoms-wi-fi-chipsets
- http://seclists.org/fulldisclosure/2019/May/24
- http://www.securityfocus.com/bid/99482
- http://www.securitytracker.com/id/1038950
- http://www.securitytracker.com/id/1039330
- https://lists.debian.org/debian-lts-announce/2018/11/msg00015.html
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-9417
- https://seclists.org/bugtraq/2019/May/30
- https://source.android.com/security/bulletin/2017-07-01
- https://support.apple.com/kb/HT210121
- https://www.blackhat.com/us-17/briefings.html#broadpwn-remotely-compromising-android-and-ios-via-a-bug-in-broadcoms-wi-fi-chipsets
