Adding OpenWrt support for Comfast CF-WA900 V2

Hi I have a Comfast CF-WA900 V2, I'm looking for an image or some pointer on how to obtain or build a version for it, not being an expert at building images (never down one for a device). I was wondering how one goes about getting a version or building one.

The CF-WA900 V2 have the following in it

CF-WA900 V2
Chipset: Qualcomm QCA9558+QCA9880+AR8035

DDR: 256MB; Flash: 16MB;
PA Chipset: 2.4G SE2576L, 5.8G SKY85728-11
Built in Watchdog Chipset

I don't know much else apart from someone has done it but I simply cannot find anything about it

I hoping someone will be able to point me in the right direction.



Based on the table of hardware adding support could be possible, it lists a few devices with the same cpu and wifi

A feasible approach would be to try to reproduce what was made for Devolo WiFi pro 1200e, for example, here starting from the commit that adds support. It might require polishing up that's done in the subsequent commits.

mmmmmm, I don't know, I've been out of any form of coding for many, many years.

This is way out of my league. :frowning:

I would even know where to start, anymore. Install by following specific instructions ,yes.

More than that unlikely to be able to do anytime soon :frowning:

Yep put me in the ................... category.

I think, there might not be that much "coding" involved. If you can attach a serial console it might just come down to "just" tfp-booting the ath79 initramfs "standard" image with some different DeviceTrees. As soon as you have one, that gives you a shell on serial, you can work from there to find out more.

mmmmm, I'll have to open it up to see inside, if that's at all possible.
It certainly does not have any applicable IP port open to use, unfortunately.

The only external port is the gigabit POE port everything else is internal for weatherproofing, and mostly heatsink.

If you can, post HiRes PCB pictures after opening.

Full Size pic >>!

Shrunk image of the internal board

1 Like

Middle left has a column of 1x4 pin hole pads, that could be a/the serial port. Maybe you are lucky, and the reverse of the PCB has labels, and you can get a bootup log from there. Next steps could also include naming all chips and copying into text all labels. Finding the SPI-flash would be useful. The board label "XX155QH_VER1.1" is partially obscured.

The square one could well be VCC and you don't need to connect it. GND could be found with continuity beeper against GND elsewhere. Then Tx and Rx are the two, which are left. Those are correct way around once you get garble in your serial log while booting. Then getting the baud rate correct, by trial and error, would make the garble legible. At least in theory. :slight_smile:

It's taken me a while, but I finally thought I'd have a peak inside the ".bin" default firmware from 2018 V2.6.0 from Comfast.
Low and behold the STD firmware from them actually has the header saying MIPS OpenWrt Linux-3.10.44.

They hide the fact that's what's actually being used. Hopefully its so to speak only a matter "getting" into to it, to transfer, install the current version, now I need to figure how to do that.

The Comfast CF E380AC V2 apparently has the same major chips in it
ie Qualcomm QCA9558+QCA9880+AR8035

Anyone got any idea what the root password might be to ssh into it and yes I do get a login prompt when targeting port 22 with ssh.

The default password may be anything simple ranging from an empty password to virtually anything. root:root, admin:admin, root:password etc are quite common default username-password combinations. By searching for router default passwords you'll get more and sorted by manufacturer or by device, too.

If you have the original firmware image you could try to run 'binwalk -eM ', which will extract the image into pieces it's composed of. If you can locate a file called 'shadow' you should find a password hash for admin or root or something like that. With any luck you could be to search online for a string that produces such a hash.

For the binwalk you may need to install a Linux in a virtual box etc. At least Ubuntu/Mint has that readily in their repositories.

Having cracked it for root access, now have proper root access via SSH finally, absolutely no thanks to comfast, they are beyond useless. Singularly the very worst tech support in existence. Just abysmal, mind you I should not have been surprised seeing as the version of the "latest "firmware" is over 4 years old and is OpenWRT, which they refused to admit to anyway.

The comfast CF-E380AC has the same chipset/s in it, apparently does pretty much the same sort of things, same number of antennas etc. Does this mean that the OpenWRT version that suits it and is currently available is likely to work in the CF-WA900 as well, if it's simply installed? although I still don't understand get how to do that or I have not found the step by step how to do it.

I did work it out, it was actually easy.

It may or may not.

To be on the safe side you should get a working serial connection and see whether the bootloader (u-boot?) is accessible and allows loading images in RAM for testing. This way you can keep the working original version in flash and test images before doing anything semi-permanent.

There appears to be a "hardware port" on the board 4 pins between the 2 lots of antennas, hard to see in my photo but it is there.

I decided to take the punt and try the E380AC upgrade version, it works! :slight_smile:

Things to watch out for the CF-WA900 V2 must be reset to "factory default" after being installed or you cannot get the WiFi to work at all.

There are a couple of minor things that don't appear to work although not anything loose sleep over. The LED's work they are all blue though so not like the E380AC, The Blue power LED works. ** Update, all Leds do work with a bit of mucking around even though they state various colours in the config they are really all blue, may need cold boot to work.

Not tested much else however it appears pretty much everything else works, so in general a good result. of course it says it's a CF-E380AC v2 would be nice it said CF-WA900 v2 but thats minor.


So having run this for several days and found other than some "light" setting changes the E380AC v2 package appears to be fully compatible as it stands with a CF-WA900 v2 made by the same company, same chip-set, memory, processor, transceivers, etc same pretty much everything right out of the box. How does one get it listed in it's own right now?

You'd have to get the missing pieces, i.e. leds and possible buttons, together and post a patch adding a new device.


Change for the CF-WA900 V2 for the leds to work correctly, truly minor! :smiley: :smiley:
Regardless of what colour they might say in the system software as shown above they are really all blue in reality in the unit.

It's the only change for this hardware needed for the leds

Hi david1 i have the same product and i would like to install openwrt . could you share with us your experience and opinion what version did you install ? is a stable version? do you have some documentation? would you recommend install openwrt instead comfast version?

I took a punt initially after spending a decent amount of time checking various info about hardware and chipsets, the 380 series is the same chipset.

I then installed via the upgrade option in the Comfast 900 series V2 access point.
The fact is, it is Openwrt in the Comfast 900 series unit anyway, just a ridiculously old version, the support from Comfast is at best abysmal, just be aware you could turn it into a brick if the power gets interrupted in the middle of upgrading for instance and the configuration is a lot different and way more powerful with the openwrt frontend.

The version that matches and works perfectly for me, is currently listed for Model: COMFAST CF-E380AC v2 Platform: ar71xx/generic, they both have the same chip set

I have posted some place here the very minor changes required for the leds to indicate pretty much as they should as they are all blue as you would be aware.

Link the latest version below

I only use it as an access point, I guess one could use as a router but really it's designed as an outdoor long range access point, it does a good job of being an access point when setup.

I also installed the support for radius, I use an external radius server, the same for DHCP, so while there are many options in Openwrt for doing more, this is and was my core requirement,

If you are in Australia the ACMA has regulations about specific power limits etc, You should be aware of as you can certainly "play" with these options and add many other options, if you are going to have a lot clients connecting, then to ensure good performance limit what you make it do as large numbers of clients need ram and processor to function really well.