My presentation at Hexacon is done ! Time for public disclosure. Pictured below: remote unauthenticated code execution over-the-air (including the shell) on Proximus BBOX 3V+

Want more ? Here's how it works on ASKEY cable modems from Orange Belgium. Since it's an RTOS I leak the PSK over the air so I can join the network and demonstrate the exploit keeps the target stable :)

All the details including the slides are now available at

Well done! Will turning off WPS prevent it?

there's no option to turn it off in the web admin interface🙃 I also looked really hard but there's no switch that would block wps_monitor from starting, which means it's always exposed.

amazing stuff, enjoyed the way you broke it all down

thx 🙏

@bpreneel1