Awesome! Thanks 
Hello, I am very interested in your new method, could you please share it?
I spent the entire previous day looking for backdoors, but there's no SSH/Telnet options and other protocols in remote mananagement, it was removed from my firmware just like @jeffheijne said.
I tried all the JS methods like @carlicious said, but it just didn't work for me, I wasn't able to switch the app.js together but it is the same as the Zyxel Opal Unlocker below.
Even though, I don't have Odido as my ISP and my firmware version is
V5.70(ACDZ.5)J0_20251201, the principle is the same, it has been stripped from gui settings but once you get there theres no ssh 
. I found a very good tool for anybody else wondering how i did unlocked the GUI, https://github.com/4d000/Zyxel-Opal-Unlocker the tool is called "Zyxel-Opal-Unlocker", and even though it hasn't been tested on the EX5601-T1 it works, but it's a little janky the gui stops working and you have to use commands to navigate to the secret menus.
Could you please share your method? I could test it.
Hey,
I think in your case it would be better to try downgrading your firmware. I will send you a PM where you can download it.
No luck here, got error illegal image
Flashing my router failed. When turning on power I only see the LEDs of the Lan ports flash briefly. No serial communication. I guess that I've bricked the device.
Could you PM me too about it?
Try to use mtkuart?
Same situation here, wanted to install openwrt but router is having secure boot. After following the guide in this page, I end up bricked router, then used "mtk_uartboot" to start in RAM using this, still bricked at end.
/mtk_uartboot.exe -s com3 --aarch64 -p mt7986-ram-ddr4-bl2.bin -f openwrt-23.05.5-mediatek-filogic-zyxel_ex5601-t0-ubootmod-bl31-uboot.fip
each time it flashed openwrt it ends like this, any help?
<5>[ 124.497410] ubi0: scanning is finished
<5>[ 124.546201] ubi0: attached mtd5 (name "ubi", size 474 MiB)
<5>[ 124.551966] ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
<5>[ 124.559095] ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
<5>[ 124.566121] ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
<5>[ 124.573323] ubi0: good PEBs: 1898, bad PEBs: 0, corrupted PEBs: 0
<5>[ 124.579658] ubi0: user volume: 4, internal volumes: 1, max. volumes count: 128
<5>[ 124.587118] ubi0: max/mean erase counter: 18/4, WL threshold: 4096, image sequence number: 269551060
<5>[ 124.596490] ubi0: available PEBs: 0, total reserved PEBs: 1898, PEBs reserved for bad PEB handling: 40
<5>[ 124.606041] ubi0: background thread "ubi_bgt0d" started, PID 3801
UBI device number 0, total 1898 LEBs (482000896 bytes, 459.6 MiB), available 0 LEBs (0 bytes), LEB size 253952 bytes (248.0 KiB)
Volume ID 2, size 35 LEBs (8888320 bytes, 8.4 MiB), LEB size 253952 bytes (248.0 KiB), dynamic, name "fit", alignment 1
Set volume size to 458891264
Volume ID 3, size 1807 LEBs (458891264 bytes, 437.6 MiB), LEB size 253952 bytes (248.0 KiB), dynamic, name "rootfs_data", alignment 1
sysupgrade successful
umount: can't unmount /dev: Reso<0>[ 134.069018] reboot: Restarting system
urce busy
umoun
F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 3903 0041
F3: 1001 0000 [0200]
F3: 1001 0000
F6: 102C 0000
F5: 1026 0000
00: 1005 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 3903 0041
F3: 1001 0000 [0200]
F3: 1001 0000
F6: 102C 0000
01: 102A 0001
02: 1005 0000
BP: 2000 00C0 [0001]
EC: 0000 0000 [1000]
T0: 0000 00BB [010F]
System halt!
What instructions did you follow?
Booted into router with mtkuarboot
Used insmod mtd-rw.ko with i_want_a_brick=1
Used ubimkvol to create partitions and then used mtd write
Lastly, used sysupgrade with itb image downloaded from openwrt.
Manual commands on usb to serial cables soldered on router board using putty.
Same guide as on T56 page with a small changes that I was using latest firmware,
Hi, I'm a noob but got this router too, for the idea to install openwrt. I've tried the usual methods and similar to lmarkiewicznr2-ui, I'm stuck, although he has gone further and understands more. I the got a serial adapter and determined that the output of BP: 2400 0209 [0000], hence locked, no ssh options either, not even a firmware upload option in the webui.
I'm on V5.70(ACDZ.5.1)C0 and its changelog pdf dates as december 2025.
Can I get in on your new method too please?
There's still zyeng - https://github.com/ndandanov/zyxel-ex5601-t0-openwrt/blob/main/guide/guide.md.
Your router is unresponsive even after installation. You made a mistake when creating a partition, or something else could have gone wrong. Previously it was reaching to zhal prompt but now it is bricked to its core. Please try using a serial connection with this tool it will automatically repair the bootloader and FIP. Use "menu-based recovery" option.
I’ve got some good news and some bad news. The good news is that the guide really helped me get my routerrunning! It’s not completely fixed, still technically bricked. I used menu based recovery with option 5 and 6. which repair BL and FIP. I am happy at least I can access the prompt now, and it actually boots up. The catch is that the password prompt is gone, so I’m landing in the prompt with ZHAL> now.
As for the bad news, I still can’t flash my router, but I’m feeling hopeful that I will figure it out. I tried using mtkuarboot again, but it didn’t work out this time either. The router didn’t crash, so I know I’m just messing something up. I’ll send over the logs when I give mtkuarboot another shot. I’ve got a serial connection, so I don’t need the uart-free installation, but I tried it anyway and ran into an errors, I think it’s not supposed to run from temporary mtkuarboot booted system.
If the mtkuartboot works, then you can just follow the guide. Note the bit about running at tftp server on 192.168.1.254. I've found the instructions to be very helpful. I have flashed quite a few ex5601's now.
A couple of issues I found were the wget command didn't work as is, maybe the time was incorrect. I setup an alias so I could copy and paste the commands as is. alias wget='wget --no-check-certificate'
Also in the instructions, you wget the ipk file, but if you already have internet enough to wget, you could just do "opkg update; opkg install kmod-mtd-rw". Happy to help more interactively if you need help getting it flashed!
You could also remove the s in https in the URL(s).
TFTP worked this time, big thanks to everyone who helped me out!
Hello, I tried almost everything. At the end I got access to user ZySH but I can't do sys atsh or anything because it just blocks it. Does anybody have a solution? I'm doing zyeng but it asks for the admin password and i don't have it.
I ran into a bit of similar issue with my router getting bricked after a mistake I made. Before that happened, I was dealing with a password error in the Zhal shell. What ended up working for me was using a debricker to repair the bootloader and fip. After that, it stopped asking for a password, and I was able to do sys atsh and install openwrt with t56 page guide.
Hello, I have discovered a new method on how to get root password without admin or root/supervisor credentials.
I really need some feedback on how it is performing! I'd really appreciate it!!
You only need user and a serial connection.
I followed this guide which has info how to flash openwrt with locked boot but with admin credentials.
I followed the guide until the Getting into ZySH section.
Now here's the trick!
Instead of clicking enter to get to console (which resulted in having to type admin credentials, which I didn't have)
You just interrupt the autoboot process. It might ask you for a password like it did for me.
I don't know how it didn't ask for the password later, but here are my 3 theories.
Theory 1
I had zyeng set to the incorrect internet adapter
Theory 2
I pressed enter for console, typed in login user and my user password, when it said incorrect login I just restarted and got to ZHEL>
Theory 3
I typed in login root and just pressed enter for the password, then restarted and got to ZHEL>
I'm not sure how i skipped the password prompt but I did it somehow.
And this is the part how you get supervisor password:
Instead of running sys atsh, sys atwz etc.
You can run it directly from zhal.
I ran atsh, copied mac address and entered atwz like this:
atwz {mac address},0,1,0,0
Then you run atck to get supervisor password.
From this point on you can either install openwrt by ssh or serial.
Here's the guide to unlock bootloader:
Now you type atgu to unlock the bootloader 3 times until it says MT7986>
You do it like this:
When you press enter after atgu just start spamming the space key. You will most likely end up in ZHAL> again, then just do it again until it says MT7986>
Now I ran into an issue that I couldn't press the spacebar, because it said something about TFTP server being active and downloading and downloading failed so you couldn't get into zhal by that.
I managed to resolve that by just disabling the routing rule thst zyeng sets (ip route add 225.0.0.0/32 dev lo). Instead of that run ip route del 225.0.0.0/32 dev lo
It will fix the TFTP server issue and you'll get into zhal again and finally manage to get to MT7986>
Then you just continue with booting openwrt recovery in ram
Please try this and leave your feedback!!!