ZyXEL NBG5715

ZyXEL NBG5715

Manuf (OEM/ODM): MitraStar

FCC approval date: 16 September 2011
(Est.) release date: 10 August 2011
UPC: 760559119652 (UPC DB, On eBay)
Country of manuf.: Taiwan

Amazon image

ASIN
B005GRFC82 (, On Amazon, On CCC)

Type: wireless router

FCC ID: I88NBG5715
PCB ID: 45-402-000341

Power: 12 VDC, 2 A
Connector type: barrel

CPU1: Mindspeed Comcerto 1000 (450 MHz, 2 cores)
CPU2: Ralink RT3883 (500 MHz)
FLA1: 128 MiB134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br /> (Samsung K9F1G08U0C-PCB0)
RAM1: 128 MiB134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br /> (Nanya NT5TU32M16CG-25C × 2)
RAM2: 64 MiB67,108,864 B <br />524,288 Kib <br />65,536 KiB <br />512 Mib <br />0.0625 GiB <br /> (Nanya NT5TU32M16CG-25C)

Expansion IFs: USB 2.0
USB ports: 2

WI1 chip1: Ralink RT3883
WI1 802dot11 protocols: an
WI1 MIMO config: 3x3:3
WI1 antenna connector: U.FL, RP-SMA
WI2 chip1: Ralink RT3593
WI2 802dot11 protocols: bgn
WI2 MIMO config: 3x3:3
WI2 antenna connector: U.FL, RP-SMA

ETH chip1: Mindspeed Comcerto 1000
Switch: Atheros AR8328
LAN speed: 1G
LAN ports: 4
WAN speed: 1G
WAN ports: 1

abgn

Additional chips
5GHz Power Amplifier IC;Skyworks;SE2567L;SiGe, 2567L, 111ES;3;
4-port USB Hub Controller;Genesys Logic;GL850G;;1;

Stock FW OS: Linux 2.6.33.5 OpenWrt-deriv

Default SSID: ZyXEL (19 addl. devices)
Default IP address: 192.168.1.1
the IP 192.168.1.1 is used by 1295 additional devices
of which 96 are ZyXEL devices
Default login user: blank
Default login password: 1234
blank:1234 credentials used by 48 additional devices
of which 46 are ZyXEL devices

802dot11 OUI: C8:6C:87 (2 E, 2 W)
Ethernet OUI: C8:6C:87 (2 E, 2 W)

For a list of all currently documented Mindspeed SoC's with specifications, see Mindspeed.
For a list of all currently documented Ralink chipsets with specifications, see Ralink.

---

Simultaneous Dual-Band Wireless N Media Router

Product Page

Datasheet  • Manual

Downloads : FW v.1.00(AAAG.5)C0

The Mindspeed Comcerto 1000 (M83241G-13) CPU is the main SoC for device.

The RT3883 is apparently controlled via an MII interface (it's in iNIC mode).

The RT3593 appears to be controlled via the Comcerto's PCI bus.

The firmware provided by ZyXEL is ~14.5MB.

The stock firmware is an OpenWrt-dervative firmware.

The stock WebUI is a modified LuCI.

"45-402-000341" is silkscreened on the board shown below.

The default SSID for both bands is ZyXEL.

The power adapter included with the device is a

DVE DSA-24CA-12 120200 (12V, 2A).

Additional external links

• On the OpenWrt Wiki
• On the OpenWrt forums
• http://nbg5715.shy.cz/GPL/

NBG5715_100AAAG2_open_code.tar.bz2 (04-May-2012 19:44 759M)

Serial

Telnet would seem to be enabled by default.

Credentials of root:1234 for a router w/ default settings worked fine..

cpuinfo

• cat /proc/cpuinfo
root@NBG5715:~# cat /proc/cpuinfo Processor : ARMv6-compatible processor rev 5 (v6l) BogoMIPS : 448.92 Features : swp half thumb fastmult edsp java CPU implementer : 0x41 CPU architecture: 6TEJ CPU variant : 0x1 CPU part : 0xb36 CPU revision : 5 Hardware : Comcerto 1000 (EVM) Revision : 0000 Serial : 0000000000000000

• cat /proc/version
root@NBG5715:/proc# cat /proc/version Linux version 2.6.33.5 (darren@ubuntu) (gcc version 3.4.6 (OpenWrt-2.0)) #1 Tue May 7 12:29:00 CST 2013

dmesg

• full output

isable mode tdi_reset: set Streaming disable mode comcerto-ehci comcerto-ehci.1: comcerto EHCI comcerto-ehci comcerto-ehci.1: new USB bus registered, assigned bus number 1 comcerto-ehci comcerto-ehci.1: irq 5, io mem 0x0f000000 tdi_reset: set Streaming disable mode comcerto-ehci comcerto-ehci.1: USB 2.0 started, EHCI 1.00 usb usb1: New USB device found, idVendor=1d6b, idProduct=0002 usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 usb usb1: Product: comcerto EHCI usb usb1: Manufacturer: Linux 2.6.33.5 ehci_hcd usb usb1: SerialNumber: comcerto-ehci.1 hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected SPI core: add driver si3050 si3050_attach_adapter client c726ac00 si3050 c726ac00 SPI core: attach client to adapter comcerto-spi si3050_device_probe(0xc726ac00) si3050: resetting device 0 si3050: resetting device 0 value of reg IM 0 Error si3050_device_probe client c726ac00, max_pots 0 usb 1-1: new high speed USB device using comcerto-ehci and address 2 usb 1-1: New USB device found, idVendor=05e3, idProduct=0608 usb 1-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0 usb 1-1: Product: USB2.0 Hub hub 1-1:1.0: USB hub found hub 1-1:1.0: 4 ports detected register rt2860 PCI: enabling device 0000:00:00.0 (0140 -> 0142) PCI: Setting latency timer of device 0000:00:00.0 to 64 === pAd = c82f2000, size = 666896 === RTMPAllocTxRxRingMemory, Status=0 RTMPAllocAdapterBlock, Status=0 pAd->CSRBaseAddress =0xc82e0000, csr_addr=0xc82e0000! (Reassign Efuse for 3x7x/3x9x/53xx) Size=0x3c [3c0-3fb] i2c /dev entries driver GPL NetUSB up! kc 88 : run_telnetDBGDServer start kc 225 : init_DebugD end INFO1428: NetUSB 1.100, 00020621 INFO142A: AUTH ISOC IOCTL INFO142B: usbcore: registered new interface driver KC NetUSB General Driver INFO1469: node NetUSB_Access :major 62, minor 0 INFO0076: init proc : PAGE_SIZE 4096 INFO139C: sleep to wait lan to wake up INFO02BF: use dev Name lan INFO13A5: sleep to wait lan end. INFO13BE: UDP_BROAD 7417 tcpPort:20005 INFO02BF: use dev Name lan INFO12F5: tcpConnector() started... Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. input: gpio-buttons as /devices/platform/gpio-buttons/input/input0 comcerto_i2c_init: module loaded i2c:m24_init Button Hotplug driver version 0.4.1 warning: `dnsmasq' uses 32-bit capabilities (legacy support in use) INFO11D5: Bind to lan RX DESC ffc33000 size = 2048 lan: no IPv6 routers present RTMP_TimerListAdd: add timer obj c835b4f4! RTMP_TimerListAdd: add timer obj c82fa348! RTMP_TimerListAdd: add timer obj c82f9f44! RTMP_TimerListAdd: add timer obj c82fa31c! RTMP_TimerListAdd: add timer obj c82fa69c! RTMP_TimerListAdd: add timer obj c82fa400! RTMP_TimerListAdd: add timer obj c82fa42c! RTMP_TimerListAdd: add timer obj c82fa5e8! RTMP_TimerListAdd: add timer obj c82fa614! RTMP_TimerListAdd: add timer obj c82fa640! RTMP_TimerListAdd: add timer obj c82fd53c! RTMP_TimerListAdd: add timer obj c82fd138! RTMP_TimerListAdd: add timer obj c82fd510! RTMP_TimerListAdd: add timer obj c82fd890! RTMP_TimerListAdd: add timer obj c82fd5f4! RTMP_TimerListAdd: add timer obj c82fd620! RTMP_TimerListAdd: add timer obj c82fd7dc! RTMP_TimerListAdd: add timer obj c82fd808! RTMP_TimerListAdd: add timer obj c82fd834! RTMP_TimerListAdd: add timer obj c8300730! RTMP_TimerListAdd: add timer obj c830032c! RTMP_TimerListAdd: add timer obj c8300704! RTMP_TimerListAdd: add timer obj c8300a84! RTMP_TimerListAdd: add timer obj c83007e8! RTMP_TimerListAdd: add timer obj c8300814! RTMP_TimerListAdd: add timer obj c83009d0! RTMP_TimerListAdd: add timer obj c83009fc! RTMP_TimerListAdd: add timer obj c8300a28! RTMP_TimerListAdd: add timer obj c8303924! RTMP_TimerListAdd: add timer obj c8303520! RTMP_TimerListAdd: add timer obj c83038f8! RTMP_TimerListAdd: add timer obj c8303c78! RTMP_TimerListAdd: add timer obj c83039dc! RTMP_TimerListAdd: add timer obj c8303a08! RTMP_TimerListAdd: add timer obj c8303bc4! RTMP_TimerListAdd: add timer obj c8303bf0! RTMP_TimerListAdd: add timer obj c8303c1c! RTMP_TimerListAdd: add timer obj c8306b18! RTMP_TimerListAdd: add timer obj c8306714! RTMP_TimerListAdd: add timer obj c8306aec! RTMP_TimerListAdd: add timer obj c8306e6c! RTMP_TimerListAdd: add timer obj c8306bd0! RTMP_TimerListAdd: add timer obj c8306bfc! RTMP_TimerListAdd: add timer obj c8306db8! RTMP_TimerListAdd: add timer obj c8306de4! RTMP_TimerListAdd: add timer obj c8306e10! RTMP_TimerListAdd: add timer obj c8309d0c! RTMP_TimerListAdd: add timer obj c8309908! RTMP_TimerListAdd: add timer obj c8309ce0! RTMP_TimerListAdd: add timer obj c830a060! RTMP_TimerListAdd: add timer obj c8309dc4! RTMP_TimerListAdd: add timer obj c8309df0! RTMP_TimerListAdd: add timer obj c8309fac! RTMP_TimerListAdd: add timer obj c8309fd8! RTMP_TimerListAdd: add timer obj c830a004! RTMP_TimerListAdd: add timer obj c830cf00! RTMP_TimerListAdd: add timer obj c830cafc! RTMP_TimerListAdd: add timer obj c830ced4! RTMP_TimerListAdd: add timer obj c830d254! RTMP_TimerListAdd: add timer obj c830cfb8! RTMP_TimerListAdd: add timer obj c830cfe4! RTMP_TimerListAdd: add timer obj c830d1a0! RTMP_TimerListAdd: add timer obj c830d1cc! RTMP_TimerListAdd: add timer obj c830d1f8! RTMP_TimerListAdd: add timer obj c83100f4! RTMP_TimerListAdd: add timer obj c830fcf0! RTMP_TimerListAdd: add timer obj c83100c8! RTMP_TimerListAdd: add timer obj c8310448! RTMP_TimerListAdd: add timer obj c83101ac! RTMP_TimerListAdd: add timer obj c83101d8! RTMP_TimerListAdd: add timer obj c8310394! RTMP_TimerListAdd: add timer obj c83103c0! RTMP_TimerListAdd: add timer obj c83103ec! RTMP_TimerListAdd: add timer obj c83132e8! RTMP_TimerListAdd: add timer obj c8312ee4! RTMP_TimerListAdd: add timer obj c83132bc! RTMP_TimerListAdd: add timer obj c831363c! RTMP_TimerListAdd: add timer obj c83133a0! RTMP_TimerListAdd: add timer obj c83133cc! RTMP_TimerListAdd: add timer obj c8313588! RTMP_TimerListAdd: add timer obj c83135b4! RTMP_TimerListAdd: add timer obj c83135e0! RTMP_TimerListAdd: add timer obj c83164dc! RTMP_TimerListAdd: add timer obj c83160d8! RTMP_TimerListAdd: add timer obj c83164b0! RTMP_TimerListAdd: add timer obj c8316830! RTMP_TimerListAdd: add timer obj c8316594! RTMP_TimerListAdd: add timer obj c83165c0! RTMP_TimerListAdd: add timer obj c831677c! RTMP_TimerListAdd: add timer obj c83167a8! RTMP_TimerListAdd: add timer obj c83167d4! RTMP_TimerListAdd: add timer obj c83196d0! RTMP_TimerListAdd: add timer obj c83192cc! RTMP_TimerListAdd: add timer obj c83196a4! RTMP_TimerListAdd: add timer obj c8319a24! RTMP_TimerListAdd: add timer obj c8319788! RTMP_TimerListAdd: add timer obj c83197b4! RTMP_TimerListAdd: add timer obj c8319970! RTMP_TimerListAdd: add timer obj c831999c! RTMP_TimerListAdd: add timer obj c83199c8! RTMP_TimerListAdd: add timer obj c831c8c4! RTMP_TimerListAdd: add timer obj c831c4c0! RTMP_TimerListAdd: add timer obj c831c898! RTMP_TimerListAdd: add timer obj c831cc18! RTMP_TimerListAdd: add timer obj c831c97c! RTMP_TimerListAdd: add timer obj c831c9a8! RTMP_TimerListAdd: add timer obj c831cb64! RTMP_TimerListAdd: add timer obj c831cb90! RTMP_TimerListAdd: add timer obj c831cbbc! RTMP_TimerListAdd: add timer obj c831fab8! RTMP_TimerListAdd: add timer obj c831f6b4! RTMP_TimerListAdd: add timer obj c831fa8c! RTMP_TimerListAdd: add timer obj c831fe0c! RTMP_TimerListAdd: add timer obj c831fb70! RTMP_TimerListAdd: add timer obj c831fb9c! RTMP_TimerListAdd: add timer obj c831fd58! RTMP_TimerListAdd: add timer obj c831fd84! RTMP_TimerListAdd: add timer obj c831fdb0! RTMP_TimerListAdd: add timer obj c8322cac! RTMP_TimerListAdd: add timer obj c83228a8! RTMP_TimerListAdd: add timer obj c8322c80! RTMP_TimerListAdd: add timer obj c8323000! RTMP_TimerListAdd: add timer obj c8322d64! RTMP_TimerListAdd: add timer obj c8322d90! RTMP_TimerListAdd: add timer obj c8322f4c! RTMP_TimerListAdd: add timer obj c8322f78! RTMP_TimerListAdd: add timer obj c8322fa4! RTMP_TimerListAdd: add timer obj c8325ea0! RTMP_TimerListAdd: add timer obj c8325a9c! RTMP_TimerListAdd: add timer obj c8325e74! RTMP_TimerListAdd: add timer obj c83261f4! RTMP_TimerListAdd: add timer obj c8325f58! RTMP_TimerListAdd: add timer obj c8325f84! RTMP_TimerListAdd: add timer obj c8326140! RTMP_TimerListAdd: add timer obj c832616c! RTMP_TimerListAdd: add timer obj c8326198! RTMP_TimerListAdd: add timer obj c8329094! RTMP_TimerListAdd: add timer obj c8328c90! RTMP_TimerListAdd: add timer obj c8329068! RTMP_TimerListAdd: add timer obj c83293e8! RTMP_TimerListAdd: add timer obj c832914c! RTMP_TimerListAdd: add timer obj c8329178! RTMP_TimerListAdd: add timer obj c8329334! RTMP_TimerListAdd: add timer obj c8329360! RTMP_TimerListAdd: add timer obj c832938c! RTMP_TimerListAdd: add timer obj c8331e80! RTMP_TimerListAdd: add timer obj c8331f84! RTMP_TimerListAdd: add timer obj c8331ea8! RTMP_TimerListAdd: add timer obj c8329708! RTMP_TimerListAdd: add timer obj c82f7834! RTMP_TimerListAdd: add timer obj c82faa28! RTMP_TimerListAdd: add timer obj c82fdc1c! RTMP_TimerListAdd: add timer obj c8300e10! RTMP_TimerListAdd: add timer obj c8304004! RTMP_TimerListAdd: add timer obj c83071f8! RTMP_TimerListAdd: add timer obj c830a3ec! RTMP_TimerListAdd: add timer obj c830d5e0! RTMP_TimerListAdd: add timer obj c83107d4! RTMP_TimerListAdd: add timer obj c83139c8! RTMP_TimerListAdd: add timer obj c8316bbc! RTMP_TimerListAdd: add timer obj c8319db0! RTMP_TimerListAdd: add timer obj c831cfa4! RTMP_TimerListAdd: add timer obj c8320198! RTMP_TimerListAdd: add timer obj c832338c! RTMP_TimerListAdd: add timer obj c8326580! RTMP_TimerListAdd: add timer obj c8329428! APSDCapable[0]=0 APSDCapable[1]=0 APSDCapable[2]=0 APSDCapable[3]=0 APSDCapable[4]=0 APSDCapable[5]=0 APSDCapable[6]=0 APSDCapable[7]=0 APSDCapable[8]=0 APSDCapable[9]=0 APSDCapable[10]=0 APSDCapable[11]=0 APSDCapable[12]=0 APSDCapable[13]=0 APSDCapable[14]=0 APSDCapable[15]=0 Key1Str is Invalid key length(0) or Type(0) Key1Str is Invalid key length(0) or Type(0) Key1Str is Invalid key length(0) or Type(0) Key1Str is Invalid key length(0) or Type(0) Key2Str is Invalid key length(0) or Type(0) Key2Str is Invalid key length(0) or Type(0) Key2Str is Invalid key length(0) or Type(0) Key2Str is Invalid key length(0) or Type(0) Key3Str is Invalid key length(0) or Type(0) Key3Str is Invalid key length(0) or Type(0) Key3Str is Invalid key length(0) or Type(0) Key3Str is Invalid key length(0) or Type(0) Key4Str is Invalid key length(0) or Type(0) Key4Str is Invalid key length(0) or Type(0) Key4Str is Invalid key length(0) or Type(0) Key4Str is Invalid key length(0) or Type(0) EntryLifeCheck=15 1. Phy Mode = 9 2. Phy Mode = 9 NVM is Efuse and its size =3c[3c0-3fb] 3. Phy Mode = 9 AntCfgInit: primary/secondary ant 0/1 MCS Set = ff ff ff 00 01 SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l RTMP_TimerListAdd: add timer obj c83299e4! Main bssid = ca:6c:87:35:8b:08 == rt28xx_init, Status=0 0x1300 = 00064320 device ra0 entered promiscuous mode lan: port 2(ra0) entering forwarding state MTD_open MTD_ioctl MTD_ioctl MTD_read MTD_close MTD_open MTD_ioctl MTD_ioctl MTD_read MTD_close eth2: no IPv6 routers present SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l SYNC - BBP R4 to 20MHz.l MTD_open MTD_ioctl MTD_ioctl MTD_read MTD_close RT3883iNIC: 802.11n WLAN MII driver v2.4.0.6 (Feb. 09, 2011) Update MAC(0)=ca:6c:87:35:8b:0c ============= Init Thread =================== RacfgTaskThread pid = 5176 RacfgBacklogThread pid = 5177 Org bridge hook = c02a425c Change bridge hook = bf32fd88 rai0: Ralink iNIC at 0x0, ca:6c:87:35:8b:0c MTD_open MTD_ioctl MTD_ioctl MTD_read MTD_close iNIC Open rai0 Op mode = 1 BssidNum=4 rlk_inic_mbss_init ---> Register MBSSID IF (rai1) Register MBSSID IF (rai2) Register MBSSID IF (rai3) rlk_inic_mbss_init <--- Wait for boot done... RACFG_CMD_BOOT_NOTIFY Open file: /tmp/iNIC_ap.bin Open file: /tmp/iNIC_ap.dat RACFG_CMD_BOOT_INITCFG(0) RACFG_CMD_BOOT_INITCFG(0) RACFG_CMD_BOOT_INITCFG(1) RACFG_CMD_BOOT_INITCFG(2) Send Init Cfg Data Done(3 packets) RACFG_CMD_BOOT_UPLOAD(0) RACFG_CMD_BOOT_UPLOAD(1) RACFG_CMD_BOOT_UPLOAD(2) CRC:01 08 14 18 72 11 a4 aa 22 32 2e 35 2e 30 2e 34 22 00 00 00 32 30 31 32 31 31 32 32 00 00 00 00 00 00 00 00 a4 6e 08 00 Send RT3883iNIC Firmware Done =================================== version: "2.5.0.4" size: 552612 bytes date: 20121122 =================================== Send STARTUP to RT3883iNIC Close Firmware file RACFG_CMD_BOOT_STARTUP ra0: no IPv6 routers present Update MAC(0)=ca:6c:87:35:8b:0c Update MAC(1)=ca:6c:87:35:8b:0d Update MAC(2)=ca:6c:87:35:8b:0e Update MAC(3)=ca:6c:87:35:8b:0f Warning! MAC addr not equal to MII master => set MiiMasterMac=c8:6c:87:35:8b:0f You've assigned a different MAC. device rai0 entered promiscuous mode lan: port 3(rai0) entering forwarding state MTD_open MTD_ioctl MTD_ioctl MTD_read MTD_close MTD_open MTD_ioctl MTD_ioctl MTD_read MTD_close ip6t_ah: Unknown symbol ipv6_find_hdr ip6table_filter: Unknown symbol ip6t_unregister_table ip6table_filter: Unknown symbol ip6t_register_table ip6table_filter: Unknown symbol ip6t_do_table ip6table_mangle: Unknown symbol ip6t_unregister_table ip6table_mangle: Unknown symbol ip6t_register_table ip6table_mangle: Unknown symbol ip6t_do_table ip6table_raw: Unknown symbol ip6t_unregister_table ip6table_raw: Unknown symbol ip6t_register_table ip6table_raw: Unknown symbol ip6t_do_table NET: Registered protocol family 27 ip_tables: (C) 2000-2006 Netfilter Core Team ip6_tables: (C) 2000-2006 Netfilter Core Team comcerto_fpp_module_init comcerto_fpp_probe fpp fpp: firmware: requesting fpp.axf FPP is running $Version: fpp_7_00_5_1 $ vwd_init: created vwd device(252, 0) vwd_driver_init: start vwd_up: start vwd_init_buffers: txQ : c0434000:86474000 vwd_init_buffers: expt rxQ : c0434800:86474800 vwd_up: start1 vwd_driver_init: end Netfilter messages via NETLINK v0.30. nf_conntrack version 0.5.0 (1835 buckets, 7340 max) CONFIG_NF_CT_ACCT is deprecated and will be removed soon.Please use nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or sysctl net.netfilter.nf_conntrack_acct=1 to enable it. ctnetlink v0.93: registering with nfnetlink. vwd_open : minor device -> 0 vwd_ioctl: start vwd_handle_vap function called 0: ra0 vwd_handle_vap:ADD: name:ra0, vapid:0 ifindex:9 mac:c8:6c:87:35:8b:f vwd_close rai0: no IPv6 routers present c1k_set_fast_path_enable 1 eth0: c1k_eth_close c1k_eth_open: eth0 Disabling GEM1 delay comcerto gemac1 software config using RGMII PHY start: 0:04 c1k_set_fast_path_enable 1 eth2: c1k_eth_close c1k_eth_open: eth2 Disabling GEM0 delay comcerto gemac0 software config using RGMII vwd_proc_write_fast_path: Wifi fast path enabled c1k_show_fast_path_enable comcerto_cap_init comcerto_cap_driver_init: start comcerto_cap_register_capdev: comcerto_cap_register_capdev:

Other

• lsmod

root@NBG5715:~# lsmod Module Size Used by Tainted: P comcerto_cap 3969 0 xt_webstr 2904 0 xt_string 864 0 ipt_REJECT 1568 0 qoscom 36844 0 xt_CONNMARK 844 0 nf_conntrack_netlink 13620 0 nf_nat 11272 0 nf_conntrack_ipv6 8787 0 nf_conntrack_ipv4 8210 2 nf_nat nf_conntrack 44963 5 xt_CONNMARK,nf_conntrack_netlink,nf_nat,nf_conntrack_ipv6,nf_conntrack_ipv4 nf_defrag_ipv4 658 1 nf_conntrack_ipv4 nfnetlink 1807 3 nf_conntrack_netlink comcerto_vwd 9954 0 fci 3172 5 comcerto_fpp 6663 5 comcerto_cap,comcerto_vwd,fci xt_tcpudp 1840 4 iptable_filter 852 1 ip6_tables 9703 0 ip_tables 9277 1 iptable_filter csmencaps 15027 0 ip6t_mh 704 0 ip6t_eui64 724 0 ip6t_REJECT 2016 0 rt3883_iNIC 55569 0 xt_MARK 500 0 x_tables 9126 11 xt_webstr,xt_string,ipt_REJECT,xt_CONNMARK,xt_tcpudp, ip6_tables,ip_tables,ip6t_mh,ip6t_eui64,ip6t_REJECT,xt_MARK cls_fw 3020 0 sch_htb 11700 0 button_hotplug 2600 0 st_m24_eeprom 2116 0 i2c_comcerto 5012 0 gpio_buttons 1940 0 input_polldev 2080 1 gpio_buttons usb_storage 33111 0 NetUSB 159211 0 GPL_NetUSB 2543 1 NetUSB i2c_dev 3896 0 i2c_core 13218 3 st_m24_eeprom,i2c_comcerto,i2c_dev rt3593ap 1206647 1 input_core 17756 4 button_hotplug,gpio_buttons,input_polldev si3050 6396 0 ahci 27636 0 ehci_hcd 29161 0 sd_mod 22828 0 pwrmgmt 2372 0 tun 9204 0 ppp_async 5600 0 ppp_generic 18093 1 ppp_async slhc 4287 1 ppp_generic vfat 7524 0 fat 41509 1 vfat ext3 86606 0 jbd 34011 1 ext3 ext2 47428 0 nls_iso8859_15 3368 0 nls_iso8859_1 2856 0 nls_cp437 4388 0 libata 117229 1 ahci scsi_mod 65287 3 usb_storage,sd_mod,libata mbcache 4148 1 ext2 crc_ccitt 967 1 ppp_async m83xxx_elp 76634 0 cryptosoft 11836 0 cryptodev 10744 0 ocf 20927 3 m83xxx_elp,cryptosoft,cryptodev ecb 1204 0

• ps aux

root@NBG5715:~# ps aux PID Uid VmSize Stat Command 1 root 368 S init 2 root SW [kthreadd] 3 root SW [ksoftirqd/0] 4 root SW [watchdog/0] 5 root SW [events/0] 6 root SW [cpuset] 7 root SW [khelper] 10 root SW [async/mgr] 89 root SW [sync_supers] 91 root SW [bdi-default] 93 root SW [kblockd/0] 98 root SW [ksuspend_usbd] 103 root SW [khubd] 119 root SW [rpciod/0] 128 root SW [khungtaskd] 129 root SW [kswapd0] 130 root SW [aio/0] 131 root SW [nfsiod] 132 root SW [crypto/0] 209 root SW [mtdblockd] 259 root SW [kondemand/0] 260 root SW [kconservative/0] 276 root SWN [jffs2_gcd_mtd6] 596 root SWN [jffs2_gcd_mtd2] 674 root 384 S logger -s -p 6 -t 675 root 220 S init 827 root 288 S klogd -c1 931 root 232 S /sbin/hotplug2 --persistent --max-children 1 1623 root 404 S udhcpc -t 0 -i eth0 -H NBG5715 -b -p /var/run/eth0.pi 2816 root SW [crypto] 2817 root SW [crypto_ret] 3164 root SW [ata/0] 3194 root SW [ata_aux] 3577 root SW [ telnetDBGD ] 3584 root SW [ acktelnetDBGD ] 3586 root DW [NU INITSOCK] 3588 root SW [NU UDP] 3590 root SW [NU TCP] 3620 root SW [ipolldevd] 3631 root 352 S syslogd -C128 3652 root 288 S klogd 3760 nobody 356 S dnsmasq -z -i lan -K -F 192.168.1.33,192.168.1.64,255 3925 root 336 S watch -tn 1 wps_conf_24G 4047 root 336 S watch -tn 1 wps_conf_5G 4382 root SW [RtmpCmdQTask] 4385 root SW [RtmpWscTask] 4403 root 296 S /usr/sbin/miniupnpd -f /tmp/miniupnpd.conf 5176 root SW [RaCfg Task] 5177 root SW [RaCfg Backlog] 6205 root 312 S /usr/sbin/dropbear -p 22 6213 root 276 S /sbin/lld2d lan 6322 root 264 S telnetd -l /bin/login -p 23 6458 root 368 S /usr/sbin/uhttpd -f -h /www -r NBG5715 -x /cgi-bin -t 6625 root SW [vwd_rx] 6664 root 1396 S /usr/bin/cmm -f /etc/config/fastforward 6669 root 1396 S /usr/bin/cmm -f /etc/config/fastforward 6670 root 1396 S /usr/bin/cmm -f /etc/config/fastforward 6671 root 1396 S /usr/bin/cmm -f /etc/config/fastforward 6672 root 1396 S /usr/bin/cmm -f /etc/config/fastforward 7075 root 560 S wscd -a 192.168.1.1 -i ra0 -m 1 -D 7077 root 560 S wscd -a 192.168.1.1 -i ra0 -m 1 -D 7078 root 560 S wscd -a 192.168.1.1 -i ra0 -m 1 -D 7079 root 560 S wscd -a 192.168.1.1 -i ra0 -m 1 -D 7080 root 560 S wscd -a 192.168.1.1 -i ra0 -m 1 -D 7081 root 560 S wscd -a 192.168.1.1 -i ra0 -m 1 -D 7083 root 560 S wscd -a 192.168.1.1 -i ra0 -m 1 -D 7084 root 560 S wscd -a 192.168.1.1 -i ra0 -m 1 -D 7085 root 560 S wscd -a 192.168.1.1 -i ra0 -m 1 -D 7086 root 560 S wscd -a 192.168.1.1 -i ra0 -m 1 -D 7087 root 560 S wscd -a 192.168.1.1 -i ra0 -m 1 -D 7091 root 560 S wscd -a 192.168.1.1 -i ra0 -m 1 -D 7148 root 560 S wscd -a 192.168.1.1 -i rai0 -m 1 -D 7152 root 560 S wscd -a 192.168.1.1 -i rai0 -m 1 -D 7153 root 560 S wscd -a 192.168.1.1 -i rai0 -m 1 -D 7154 root 560 S wscd -a 192.168.1.1 -i rai0 -m 1 -D 7155 root 560 S wscd -a 192.168.1.1 -i rai0 -m 1 -D 7156 root 560 S wscd -a 192.168.1.1 -i rai0 -m 1 -D 7157 root 560 S wscd -a 192.168.1.1 -i rai0 -m 1 -D 7158 root 560 S wscd -a 192.168.1.1 -i rai0 -m 1 -D 7160 root 560 S wscd -a 192.168.1.1 -i rai0 -m 1 -D 7162 root 560 S wscd -a 192.168.1.1 -i rai0 -m 1 -D 7165 root 560 S wscd -a 192.168.1.1 -i rai0 -m 1 -D 7169 root 560 S wscd -a 192.168.1.1 -i rai0 -m 1 -D 8345 root 328 S crond -c /etc/crontabs 9995 root SW [pcap_rx] 10302 root 336 S watch -tn 2 /bin/link_monitor 13710 root 432 S -ash 19454 root 368 R ps aux

• netstat -l

root@NBG5715:~# netstat -l Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 *:49152 *:* LISTEN tcp 0 0 *:33344 *:* LISTEN tcp 0 0 *:49153 *:* LISTEN tcp 0 0 *:20005 *:* LISTEN tcp 0 0 *:5000 *:* LISTEN tcp 0 0 *:80 *:* LISTEN tcp 0 0 localhost:53 *:* LISTEN tcp 0 0 myrouter:53 *:* LISTEN tcp 0 0 *:2103 *:* LISTEN tcp 0 0 *:80 *:* LISTEN tcp 0 0 ::1:53 *:* LISTEN tcp 0 0 fe80::ca6c:87ff:fe35:53 *:* LISTEN tcp 0 0 *:22 *:* LISTEN tcp 0 0 *:23 *:* LISTEN udp 0 0 *:35381 *:* udp 0 0 localhost:53 *:* udp 0 0 myrouter:53 *:* udp 0 0 *:67 *:* udp 0 0 *:1900 *:* udp 0 0 *:1900 *:* udp 0 0 *:1900 *:* udp 0 0 localhost:39546 *:* udp 0 0 localhost:37856 *:* udp 0 0 myrouter:5351 *:* udp 0 0 myrouter:60415 *:* udp 0 0 ::1:53 *:* udp 0 0 fe80::ca6c:87ff:fe35:53 *:* raw 0 0 *:255 *:* 0 Active UNIX domain sockets (only servers) Proto RefCnt Flags Type State I-Node Path

• iwconfig

root@NBG5715:~# iwconfig lo no wireless extensions. eth2 no wireless extensions. eth0 no wireless extensions. tunl0 no wireless extensions. sit0 no wireless extensions. ip6tnl0 no wireless extensions. ethipip6tnl0 no wireless extensions. lan no wireless extensions. ra0 RTWIFI SoftAP ESSID:"ZyXEL" Mode:Managed Channel=11 Access Point: CA:6C:87:35:8B:08 Bit Rate=450 Mb/s ra1 RTWIFI SoftAP ESSID:"RT3593AP2" Mode:Managed Channel=11 Access Point: CA:6C:87:35:8B:09 Bit Rate=450 Mb/s ra2 RTWIFI SoftAP ESSID:"RT3593AP3" Mode:Managed Channel=11 Access Point: CA:6C:87:35:8B:0A Bit Rate=450 Mb/s ra3 RTWIFI SoftAP ESSID:"RT3593AP4" Mode:Managed Channel=11 Access Point: CA:6C:87:35:8B:0B Bit Rate=450 Mb/s rai0 iNIC AP ESSID:"ZyXEL" Nickname:"" Mode:Master Frequency:5.18 GHz Access Point: CA:6C:87:35:8B:0C Bit Rate=450 Mb/s rai1 iNIC AP ESSID:"RT3883_5G2" Nickname:"" Mode:Master Frequency:5.18 GHz Access Point: CA:6C:87:35:8B:0D Bit Rate=450 Mb/s rai2 iNIC AP ESSID:"RT3883_5G3" Nickname:"" Mode:Master Frequency:5.18 GHz Access Point: CA:6C:87:35:8B:0E Bit Rate=450 Mb/s rai3 iNIC AP ESSID:"RT3883_5G4" Nickname:"" Mode:Master Frequency:5.18 GHz Access Point: CA:6C:87:35:8B:0F Bit Rate=450 Mb/s cap_wan no wireless extensions. cap_lan no wireless extensions.

• ipkg list

root@NBG5715:/proc# ipkg list asterisk - 1.2.7.1-1 - asterisk-addons - 1.2.5-1 - asterisk-voicemail - 1.2.7.1-1 - base-files-comcerto1000 - 14-r843 - bridge - 1.4-1 - busybox - 1.4.2-1 - chksum-tool - 0.1-1 - cmm - 7.00-5 - comcerto-mdio - 0.1-1 - cyclesoak - none-1 - dnsmasq - 2.38-1 - dropbear - 0.49-1 - ethtool - 3-0 - firmware-info - 0.1-1 - firmware-upgrade - 0.1-1 - fpp-firmware - 2.6.33.5+3.00.1-comcerto1000-1 - gw6c - 5.0-1 - haserl - 0.8.0-1 - hotplug2 - 0.9-1 - htp-tool - 0.1-1 - igmpproxy - 0.1-2 - ip - 2.6.35-3 - ip6tables - 1.4.7-1 - ipsec-tools - 0.6.6-1 - iptables - 1.4.7-1 - iptables-mod-conntrack - 1.4.7-1 - iptables-mod-conntrack-extra - 1.4.7-1 - iptables-mod-extra - 1.4.7-1 - iptables-mod-filter - 1.4.7-1 - iptables-mod-ipopt - 1.4.7-1 - iptables-mod-ipsec - 1.4.7-1 - iptables-mod-nat - 1.4.7-1 - iptables-mod-nat-extra - 1.4.7-1 - iptables-mod-porttrigger - 1.4.7-1 - iptables-mod-webstr - 1.4.7-1 - isakmpd - 20041012-1 - kernel - 2.6.33.5-comcerto1000-1 - keynote - 2.3-1 - kmod-accel-pptp - 2.6.33.5+0.8.5-comcerto1000-3 - kmod-ata-ahci - 2.6.33.5-comcerto1000-1 - kmod-ata-core - 2.6.33.5-comcerto1000-1 - kmod-button-hotplug - 2.6.33.5-comcerto1000-3 - kmod-crc-ccitt - 2.6.33.5-comcerto1000-1 - kmod-crypto-core - 2.6.33.5-comcerto1000-1 - kmod-crypto-ocf - 2.6.33.5-comcerto1000-1 - kmod-csme - 2.6.33.5+2.14.0-comcerto1000- - kmod-elp1800-ocf - 2.6.33.5+2.00-comcerto1000-1 - kmod-fci - 2.6.33.5+7.00-comcerto1000-1 - kmod-fpp-csme - 2.6.33.5+2.14.0-comcerto1000- - kmod-fpp-driver - 2.6.33.5-comcerto1000-1 - kmod-fpp_pcap-driver - 2.6.33.5-comcerto1000-1 - kmod-fs-ext2 - 2.6.33.5-comcerto1000-1 - kmod-fs-ext3 - 2.6.33.5-comcerto1000-1 - kmod-fs-mbcache - 2.6.33.5-comcerto1000-1 - kmod-fs-vfat - 2.6.33.5-comcerto1000-1 - kmod-i2c-comcerto - 2.6.33.5-comcerto1000-1 - kmod-i2c-core - 2.6.33.5-comcerto1000-1 - kmod-input-core - 2.6.33.5-comcerto1000-1 - kmod-input-gpio-buttons - 2.6.33.5-comcerto1000-1 - kmod-input-polldev - 2.6.33.5-comcerto1000-1 - kmod-ip6tables - 2.6.33.5-comcerto1000-1 - kmod-ipt-conntrack - 2.6.33.5-comcerto1000-1 - kmod-ipt-conntrack-extra - 2.6.33.5-comcerto1000-1 - kmod-ipt-core - 2.6.33.5-comcerto1000-1 - kmod-ipt-extra - 2.6.33.5-comcerto1000-1 - kmod-ipt-filter - 2.6.33.5-comcerto1000-1 - kmod-ipt-ipopt - 2.6.33.5-comcerto1000-1 - kmod-ipt-ipsec - 2.6.33.5-comcerto1000-1 - kmod-ipt-nat - 2.6.33.5-comcerto1000-1 - kmod-ipt-nat-extra - 2.6.33.5-comcerto1000-1 - kmod-ipt-nathelper - 2.6.33.5-comcerto1000-1 - kmod-ipt-nathelper-extra - 2.6.33.5-comcerto1000-1 - kmod-matisse - 1.00-0 - kmod-mppe - 2.6.33.5-comcerto1000-1 - kmod-nf-conntrack-netlink - 2.6.33.5-comcerto1000-1 - kmod-nfnetlink - 2.6.33.5-comcerto1000-1 - kmod-nfnetlink-queue - 2.6.33.5-comcerto1000-1 - kmod-nls-cp437 - 2.6.33.5-comcerto1000-1 - kmod-nls-iso8859-1 - 2.6.33.5-comcerto1000-1 - kmod-nls-iso8859-15 - 2.6.33.5-comcerto1000-1 - kmod-ppp - 2.6.33.5-comcerto1000-1 - kmod-pppoe - 2.6.33.5-comcerto1000-1 - kmod-pwrmgmt-api - 2.6.33.5+1.00-comcerto1000-1 - kmod-qoscom - 2.6.33.5+1.02-comcerto1000-18 - kmod-rt3593ap - 2.6.33.5+2.6.0.0-0.00.2-comcerto1000-2 - kmod-rt3883 - 2.6.33.5+2.4.0.6-0.00.2-comcerto1000-2 - kmod-sched - 2.6.33.5-comcerto1000-1 - kmod-scsi-core - 2.6.33.5-comcerto1000-1 - kmod-si3050 - 2.6.33.5+1.05-comcerto1000-1 - kmod-st-m24-eeprom - 2.6.33.5-comcerto1000-1 - kmod-tun - 2.6.33.5-comcerto1000-1 - kmod-usb-storage - 2.6.33.5-comcerto1000-1 - kmod-usb2 - 2.6.33.5-comcerto1000-1 - kmod-vwd-rtbr-driver - 2.6.33.5-comcerto1000-1 - libc - 0.9.28-14 - libcli - 1.9.3-1 - libgcc - 3.4.6-14 - libgdbm - 1.8.3-0 - libgmp - 4.2.1-1 - libiptc - 1.4.7-1 - liblua - 5.1.4-6 - liblzo - 2.04-1 - libncurses - 5.2-8 - libnetfilter-queue - 1.0.0-1 - libnfconntrack - 0.0.100 - libnfnetlink - 1.0.0 - libopenssl - 0.9.8q-1 - libpcap - 1.1.1-2 - libpthread - 0.9.28-14 - librt - 0.9.28-14 - libstdcpp - 3.4.6-14 - libuci - 12012009.6-2 - libuci-lua - 12012009.6-2 - libuuid - 1.39-1 - libxtables - 1.4.7-1 - lldt - 0.1-1 - lua - 5.1.4-6 - luci - 0.9+svn6252-1 - luci-admin-core - 0.9+svn6252-1 - luci-admin-easy - 0.9+svn6252-1 - luci-admin-expert - 0.9+svn6252-1 - luci-app-initmgr - 0.9+svn6252-1 - luci-cbi - 0.9+svn6252-1 - luci-core - 0.9+svn6252-1 - luci-http - 0.9+svn6252-1 - luci-i18n-chinese_traditional - 0.9+svn6252-1 - luci-i18n-english - 0.9+svn6252-1 - luci-i18n-french - 0.9+svn6252-1 - luci-i18n-german - 0.9+svn6252-1 - luci-i18n-italian - 0.9+svn6252-1 - luci-i18n-spanish - 0.9+svn6252-1 - luci-ipkg - 0.9+svn6252-1 - luci-lmo - 0.9+svn6252-1 - luci-nixio - 0.9+svn6252-1 - luci-sgi-cgi - 0.9+svn6252-1 - luci-sys - 0.9+svn6252-1 - luci-theme-base - 0.9+svn6252-1 - luci-theme-zyxel - 0.9+svn6252-1 - luci-uci - 0.9+svn6252-1 - luci-uvl - 0.9+svn6252-1 - luci-web - 0.9+svn6252-1 - miniupnpd - 1.6.20110730-4 - mldproxy - 20041012-1 - mmiotool - 1.00-1 - msp-firmware - 2.6.33.5+3.00.11-comcerto1000-1 - msp-io-app - 2.6.33.5+1.00.0-comcerto1000-1 - mtd - 5 - mtd-utils - 20090227-1 - multiboot-client - 1.0.0-1 - net-tools-arp - 1.60-1 - ntpclient - 2007_365-4 - portTrigger - 2-17 - ppp - 2.4.3-7 - ppp-mod-pppoe - 2.4.3-7 - ppp-mod-pptp - 0.8.5-3 - qos-scripts - 1.1.1-1 - qosapp - 1.02-12 - radvd - 1.6-1 - rp-pppoe-relay - 3.8-1 - rtATE - 1.4.0.0-1 - tc - 2.6.35-3 - uboot-envtools - 20081215-2 - uci - 12012009.6-2 - uclibcxx - 0.2.1-1 - udevtrigger - 106-1 - uhttpd - 31 - uhttpd-mod-lua - 31 - updatedd - 2.6-7 - updatedd-mod-dyndns - 2.6-7 - updatedd-mod-eurodyndns - 2.6-7 - updatedd-mod-noip - 2.6-7 - updatedd-mod-regfish - 2.6-7 - usbtest - 20101222-2 - vapi - 2.14.0 - wide-dhcpv6-client - 20080615-6 - wide-dhcpv6-control - 20080615-6 - wide-dhcpv6-relay - 20080615-6 - wide-dhcpv6-server - 20080615-6 - wifi_list - 0.1-1 - wireless-tools - 29-1 - wlan-api - 0.1-1 - wlan-gen-psk - 0.1-1 - wlan-show-summary - 0.1-1 - wol - 0.7.1-2 - wps-api - 0.1-1 - zlib - 1.2.3-3 - Done.

• nmap output

nmTOR src # nmap 192.168.1.1 Starting Nmap 6.00 ( http://nmap.org ) at 2014-01-07 23:55 EST Nmap scan report for 192.168.1.1 Host is up (0.0088s latency). Not shown: 991 closed ports PORT STATE SERVICE 22/tcp open ssh 23/tcp open telnet 53/tcp open domain 80/tcp open http 2103/tcp open zephyr-clt 5000/tcp open upnp 20005/tcp open btx 49152/tcp open unknown 49153/tcp open unknown MAC Address: C8:6C:87:35:8B:0F (Zyxel Communications) Nmap done: 1 IP address (1 host up) scanned in 11.30 seconds

Images

• from ZyXEL
• 

  angled

• 

  front

• 

  back

• 

  another angled

• external
• 

  back

• 

  power adapter

• internal
• 

  board top, shield on

• 

  RT3883

• 

  RT3883 RAM

• 

  RT3593

• 

  RF section

• 

  Samsung Flash

• 

  board bottom

• 

  board top, shield removed

• 

  AR8328 Switch

• 

  Mindspeed CPU

• 

  Mindspeed RAM