You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: _ont/ont-zte-f6005v3.md
+78-63Lines changed: 78 additions & 63 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,22 +12,23 @@ parent: ZTE
12
12
| Vendor/Brand | ZTE |
13
13
| Model | F6005v3 |
14
14
| ODM | ✅ |
15
-
| CPU | ZTE ZX279133@A53 |
16
-
| CPU Clock |2x1200MHz|
15
+
| CPU | ZTE ZX279133@Dual-Core A53|
16
+
| CPU Clock |1200MHz |
17
17
| Chipset | ZTE ZX279133 |
18
18
| Flash | 128 MB (SPI NAND FM25S01A) |
19
19
| RAM | 128 MB |
20
20
| System | Customized Linux by ZTE |
21
-
| 2.5GBaseT |No |
21
+
| 2.5GBaseT |Yes|
22
22
| Optics | SC/APC |
23
23
| IP address | 192.168.1.1 |
24
24
| Web Gui | ✅ user `admin`, password `admin` or defined by ISP |
25
-
| SSH ||
25
+
| SSH |N/A|
26
26
| Telnet | ✅ [^1]|
27
27
| Serial | ✅ [^2]|
28
28
| Form Factor | ONT |
29
29
30
30
{% include image.html file="f6005v3_tim_1.jpg" alt="F6005v3 TIM" caption="F6005v3 TIM" %}
31
+
31
32
{% include image.html file="f6005v3_of_1.jpg" alt="F6005v3 OpenFiber" caption="F6005v3 OpenFiber" %}
32
33
33
34
@@ -55,8 +56,8 @@ parent: ZTE
55
56
| mtd10 | 029e0000 | 00020000 | "rootfs2" |
56
57
57
58
58
-
This ONT supports dual boot, as visible from the presence of `kernel0` and `kernel1`, which contain the rootfs.
59
-
The boot images can be swapped with the following command but currently not works because if U-Boot is updated, a revert will brick ONT:
59
+
This ONT supports dual boot, as visible from the presence of `kernel0` and `kernel1`, which contain the rootfs (JFFS2 read-only).
60
+
The boot images can be swapped if they are the same or use the same **U-Boot** version. If you have a different **U-Boot** that was paired with the active image, do not attempt this, as it will brick the ONT.
60
61
61
62
```sh
62
63
upgradetest switchver X
@@ -71,43 +72,58 @@ You can also clone the currently running image into the other slot using this co
71
72
syn_version
72
73
```
73
74
74
-
# Use
75
-
{% include alert.html content="Commands have been tested on V3 HW rev. on OpenFiber firmwares" alert="Note" icon="svg-info" color="blue" %}
76
-
77
-
## Enable Telnet
78
-
{% include alert.html content="This is an external script ([ZTE Telnet enabler](https://github.com/douniwan5788/zte_modem_tools)), use at your own risk! Credentials don't survive at reboot!" alert="Note" icon="svg-info" color="blue" %}
79
-
80
-
{% include alert.html content="For italian users, the script above only works only on V3.0.10P3N2 (OpenFiber)" alert="Note" icon="svg-info" color="blue" %}
75
+
You can check currenlty running image using this command:
You should get this output and credentials to login over telnet:
92
+
And check if the backup image has a valid CRC:
87
93
88
94
```sh
89
-
trying user:"CUSTOM_USER" pass:"CUSTOM_PASS"
90
-
reset facTelnetSteps:
91
-
reset OK!
95
+
# upgradetest bakver
96
+
backup version crc is ok
97
+
success!
98
+
```
92
99
93
-
facStep 1:
94
-
OK!
95
100
96
-
facStep 2:
97
-
OK!
101
+
# Use
102
+
{% include alert.html content="Commands have been tested on V3 HW rev. on OpenFiber and TIM firmwares" alert="Note" icon="svg-info" color="blue" %}
98
103
99
-
facStep 3:
100
-
OK!
104
+
## Enable Telnet
105
+
{% include alert.html content="This is an external script ([ZTE ONU Telnet Enabler](https://github.com/stich86/zteOnu)), use at your own risk! Credentials don't survive at reboot!" alert="Note" icon="svg-info" color="blue" %}
101
106
102
-
facStep 4:
103
-
OK!
107
+
```sh
108
+
./zteOnu -i 192.168.1.1 -u admin -p admin
109
+
```
104
110
105
-
facStep 5:
106
-
OK!
111
+
You should get this output and credentials to login over telnet:
107
112
108
-
done
109
-
Username: 2W3iqFVt
110
-
Password: Eqb8X8Qt
113
+
```sh
114
+
ZteONU 0.0.7, built at 09/10/2024
115
+
source: https://github.com/stich86/zteOnu
116
+
-----------------------------------
117
+
step [0] reset factory: ok
118
+
step [1] request factory mode: ok
119
+
step [2] send sq: ok
120
+
step [3] check login auth with user: ok
121
+
step [4] enter factory mode: ok
122
+
-----------------------------------
123
+
Success authenticated with user: admin and password: admin
124
+
Telnet Credentials (!! Temporary !!)
125
+
User: 9qNBo58H
126
+
Pass: OUBToR8J
111
127
```
112
128
113
129
## Enable console redirection
@@ -177,7 +193,7 @@ MIB INFO:
177
193
Is valid:01
178
194
179
195
<-----MeID[ 0x0001,1 ], Addr[ 0x19a031]----->
180
-
Version:V3.0.10P3N2
196
+
Version:V3.0.10P2N6
181
197
Is committed:00
182
198
Is active:00
183
199
Is valid:01
@@ -218,39 +234,40 @@ success!
218
234
219
235
```
220
236
221
-
## Persistent telnet access
237
+
## Persistent Telnet access
222
238
223
-
{% include alert.html content="This procedure was only tested on OF V3.0.10P3N2 firmware and it's persistent after an upgrade from OLT" alert="Note" icon="svg-info" color="blue" %}
239
+
{% include alert.html content="This procedure was only tested on OF V3.0.10P3N2 and TIM V3.0.10N06 firmware and it's persistent after an upgrade from OLT" alert="Note" icon="svg-info" color="blue" %}
224
240
241
+
{% include alert.html content="If you change GPON Serial Number, Telnet will be disabled. You have to run again the tool to enable it" alert="Note" icon="svg-warning" color="red" %}
[ZTE ONU Telnet Enabler](https://github.com/stich86/zteOnu)
230
246
247
+
Just run the enabled with `--telnet` flag to make Telnet persisten across Reboot:
231
248
232
-
After the ONT has rebooted and you can access again, telnet can be enabled on each reboot. To do this, run again `zte_factroymode.py` to open new session to it. When you are in, execute these commands:
Success authenticated with user: admin and password: admin
264
+
Permanent Telnet succeed
265
+
User: root
266
+
Pass: Zte521
267
+
Wait reboot.. or powercycle it
251
268
```
252
269
253
-
Reboot the ONT and a telnet interface will be available. You can login using `root\root` as credentials.
270
+
The ONT will reboot, and you can log in later using `root\Zte521` as the credentials.
254
271
255
272
**Just for OpenFiber firmware**
256
273
@@ -260,7 +277,7 @@ In case you want add new a admin user instead of using the embedded credentials,
260
277
sendcmd 1 DB set DevAuthInfo 5 Enable 1
261
278
sendcmd 1 DB set DevAuthInfo 5 User superadmin
262
279
sendcmd 1 DB set DevAuthInfo 5 Pass superadmin
263
-
sendcmd 1 DB set DevAuthInfo 5 Level 0
280
+
sendcmd 1 DB set DevAuthInfo 5 Level 1
264
281
sendcmd 1 DB set DevAuthInfo 5 AppID 1
265
282
sendcmd 1 DB saveasy
266
283
```
@@ -270,7 +287,6 @@ Reboot the ONT and you can login to the WebUI using `superadmin\superadmin` as c
270
287
271
288
## Backing up ONT partitions using hardware flasher
272
289
273
-
As we currently known, only firmware V3.0.10P3N2 from OpenFiber are able to open telnet (and make it persistent).
274
290
It's possible to swap RAW dump between ONTs and enable access over telnet to modify some ONT parameters.
275
291
276
292
Needed tools:
@@ -297,7 +313,7 @@ If you want to flash this dump to another ONT, just run these commands:
297
313
298
314
## Changing region code
299
315
300
-
{% include alert.html content="Be aware that changing the region code may break features such as PPPoE depending on your ISP, and remove telnet access!" alert="Note" icon="svg-info" color="blue" %}
316
+
{% include alert.html content="Be aware that changing the region code may break features such as PPPoE depending on your ISP, and remove Telnet access!" alert="Note" icon="svg-info" color="blue" %}
301
317
302
318
ZTE has created various region codes that load default values based on the local ISP. This configuration can be changed using this command:
303
319
@@ -320,22 +336,21 @@ Where X is the number of supported regioncode into file `/etc/init.d/regioncode`
320
336
```
321
337
322
338
# Random notes
323
-
- F6005v3 read the software version exposed through the gpon_omci deamon from each kernel partition header, so the only way to spoof this parameter is to change the version in the header and recalculate CRC, otherwise the bootloader will refuse to load the image.
339
+
-**ZTE F6005v3** read the software version exposed through the `gpon_omci` deamon from each kernel partition header, so the only way to spoof this parameter is to change the version in the header and recalculate CRC, otherwise the bootloader will refuse to load the image.
340
+
- If your ONT is updated by the OLT (e.g., an F6005v3 OpenFiber ONT connected to a TIM OLT), the U-Boot partition will also be updated. After this update, it will no longer be possible to switch to the other partition because the signatures will not match.
-[ZTE ONU Telnet Enabler](https://github.com/stich86/zteOnu)
328
345
329
346
# Teardown and other photos
330
347
331
348
## HW V3.0
332
349
333
350
{% include image.html file="f6005v3_2.jpg" alt="Top of the F6005v3" caption="Top of the F6005v3" %}
334
-
{% include image.html file="f6005v3_3.jpg" alt="Bottom of the F601 v6" caption="Bottom of the F6005v3" %}
335
-
336
-
351
+
{% include image.html file="f6005v3_3.jpg" alt="Bottom of the F6005v3" caption="Bottom of the F6005v3" %}
337
352
338
353
---
339
354
340
-
[^1]: Credentials are randomly generated by zte_factroymode.py, they are not persistent and will change at reboot.
355
+
[^1]: Credentials are randomly generated by ZTE ONU Telnet Enabler, they are not persistent and will change at reboot.
341
356
[^2]: Serial console is read-only mode on most of U-Boot, and no output after kernel load. For OF V3.0.10P3N2 is possible after pressing ESC during the boot to access U-Boot Console.
0 commit comments