Researchers have uncovered a critical vulnerability in Broadcom's proprietary WPS implementation that allows unauthenticated attackers within WiFi range to achieve remote code execution on millions of routers. Discovered via agentic vulnerability research, the flaw impacts both eCos and Linux platforms and was accompanied by a notably unusual disclosure process.