BaudTec TW263R4

From HWMN
Jump to: navigation, search
Front side of a Greek OTE conn-x branded BaudTec TW263R4 802.11b/g ADSL router.
Back side.
Bottom.
The bottom of the printed circuit board (PCB) inside.
The top view on the PCB shows the Trendchip TC 3162 processor.
First screen of the WebUI when logging in after reset.

This Wireless ADSL modem and router seems to run the same Firmware as the Edimax AR-7084gA And it might be hardware-wise identical to one of the ZyXEL P-660W series devices.


Hardware[edit]

External Connectors[edit]

  • Power connector
  • 3 Straight 8P8C Fast Ethernet
  • Cross-Link 8P8C Fast Ethernet
  • RJ11/6P2C aDSL connector

Internal Connectors[edit]

  • IPX/U.FL Antenna connector
  • Joint Test Action Group IEEE 1149.1 Connector (JTAG) - unpopulated
  • Serial Peripheral Interface Bus (SPI) - unpopulated

Chips on the PCB[edit]

Producer Part number Purpose
Trendchip TC3162P2-PQ208G Processor
Trendchip TC3085-TO64-EPG aDSL controller
Ralink RT2561ST 802.11bg Wireless controller
Ralink RT2527L  ???
IC Plus IC175C LF Ethernet switch
ESMT M12L64164A-7T 226bit = 8MiB Synchronous DRAM
 ???  ??? Flash memory

Other[edit]

  • 8 LEDs (Power, "Link", "Internet", "WLAN", Ethernet 1-4)
  • Reset button

Software[edit]

Firmware: ZyNOS

Default Login
User: admin
Pass: 1234

CPE WAN Management Protocol (CWMP)[edit]

CWMP remote configuration is by default enabled and the CWMP submenu in the Access Management menu (where that can be changed) is by default deactivated. This means, that the device opens a backdoor for OTE to read and change the configuration and to do basically anything they want on your network! Fortunately they were not very careful, and the menu items can be activated again via CSS using FireBug. Then the CWMP can be disabled through the reactivated menu. If this really stops the device from remote control still has to be tested.

Telnet Console[edit]

The device runs a telnet server which serves a command line interface (CLI). If connected to the server it will prompt for the root password (default:1234) and then for commands like this:

   Password: ****
   Copyright (c) 2001 - 2006 TrendChip Technologies Corp.
   tc> 

Entering an incorrect command will result in a list of valid commands.

   tc> ls
   Valid commands are:
   sys             exit            ether           wan               
   ip              bridge          dot1q           pktqos            
   show            set             lan                               

Entering an incomplete command will result in a list of valid command options.

   tc> show
   wan             lan             cpe             community         
   channel         all                                               

A good reference to the ZyNOS CLI can be found on the ZyXEL web site and here.