mirror of
https://github.com/LiBwrt-op/openwrt-6.x.git
synced 2025-12-26 05:49:14 +00:00
cbc2cdbb80
This commit adds support for a dual-band AC1200 wall plug
manufactured by Shenzhen Century Xinyang Tech Co., Ltd.
SoC: Mediatek MT7628AN (MIPS 24KEc single core, 580 MHz)
RAM: 128 MiB DDR2 (Hynix HY5PS1G1631C)
ROM: 8 MiB SPI NOR (Zbit ZB25VQ64ASIG)
Wired: one FE RJ45 port (+ an unpopulated footprint for a 2nd)
WiFi: Mediatek MT7612E
Ant.: four 2 dBi external antennas (two 2.4GHz, two 5 GHz)
LEDs: - Power (green, always on)
- 2.4G (green, controlled by MT7628)
- 5G (green, controlled by MT7612)
- Extender (green, GPIO 37, used as status LED)
- LAN (green/yellow, controlled by RT3050 ESW)
Buttons: WPS and reset (both connected to GPIO 38)
Power: 5V 2-pin JST-XH on main PCB
110/220V AC to 5V 1.5A DC on auxiliary PCB
UART: 57600 8n1 3.3v, holes available on the PCB as J5
pinout is (Gnd) (Tx) (Rx)
MAC: 1C:BF:CE:xx:xx:xx (2.4 GHz, label)
1C:BF:CE:xx:xx:xx + 1 (LAN)
1C:BF:CE:xx:xx:xx + 2 (WAN, not in use)
1C:BF:CE:xx:xx:xx + 3 (5 GHz)
Original firmware is Chaos Calmer 15.05.01 (kernel 3.10.108)
with a few custom packages and a non-LuCI web interface.
Telnet is enabled, requiring an unknown root password [1].
Root password is also needed to access the router via UART console,
but passwordless telnet can be enabled via a trivial web exploit [2]
and then the root password can be removed by editing `/etc/shadow`.
Installation: Upload `sysupgrade` binary via web interface at
`http://192.168.188.1/settings.shtml`. Alternatively, remove
root password and use u-boot menu to flash image via TFTP.
Notes:
- Device model in Chaos Calmer is "mtk-apsoc-demo".
- It is sold under several brands, e.g., Fenvi and Linkavenir.
It is available in two colors: white and black.
- PCB is marked "WD206AD v1.0".
- Instead of a standard ethernet transformer, the PCB has a few tiny
SMD coils.
- The housing is identical to the one used by a 2020 model,
WD-R1203U, which is RTL8812-based. The older model has an FCC
listing with external and internal images: ZNPWD-R1203U.
The FCC listing contains a letter [3] claiming WD-R1203U and
WD-R1208U are internally identical, but evidently they are not.
[1] root:$1$7rmMiPJj$91iv9LWhfkZE/t7aCBdo.0:18388:0:99999:7:::
This is the same hash as in Wodesys WD-R1802U.
There are other root password hashes in `/etc/shadow_sf` and
`/etc/shadow_yn`.
[2] curl -X POST http://192.168.188.1/cgi-bin/adm.cgi \
-d page=Lang -d langType="en;killall telnetd;telnetd -l /bin/sh"
[3] https://fcc.report/FCC-ID/ZNPWD-R1203U/4767033
Signed-off-by: Rani Hod <rani.hod@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19535
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
|
||
|---|---|---|
| .. | ||
| airoha | ||
| apm821xx | ||
| armsr | ||
| at91 | ||
| ath79 | ||
| bcm27xx | ||
| bcm47xx | ||
| bcm53xx | ||
| bcm4908 | ||
| bmips | ||
| d1 | ||
| gemini | ||
| generic | ||
| imx | ||
| ipq40xx | ||
| ipq806x | ||
| ixp4xx | ||
| kirkwood | ||
| lantiq | ||
| layerscape | ||
| loongarch64 | ||
| malta | ||
| mediatek | ||
| mpc85xx | ||
| mvebu | ||
| mxs | ||
| octeon | ||
| omap | ||
| pistachio | ||
| qoriq | ||
| qualcommax | ||
| qualcommbe | ||
| ramips | ||
| realtek | ||
| rockchip | ||
| sifiveu | ||
| siflower | ||
| starfive | ||
| stm32 | ||
| sunxi | ||
| tegra | ||
| uml | ||
| x86 | ||
| zynq | ||
| Makefile | ||