EIR D2000 Zyxel ISP Provided ADSL Modem *BIN Find*


Seems that as someone was moving they were trashing their Zyxel "D2000" DSL modem, which I luckily found before the truck took it to the never after blue smoke vanquisher.

I am happy to report that this baby has included a serial port running at 115200, but as luck would have it the firmware no longer has the security issue that was that "fixed" user and password found some time back.

My problem is that I am unable to upgrade the firmware on this thing, it does accept the firmware file to be uploaded, which unless I made a big boo boo is the firmware for ZyXEL Keenetic Extra II that took me a big to find by cross-referencing hardware specs starting with the CPU and then down from there.
With that every hardware bit matches exactly the device in question.

Although the upload is successful the looking at our newly installed Serial Terminal we notice that it fails to install due to a "write" protection flag that is password protected (this one seems to be based on a calculation, not a static saved one, as far as I care sooner or later this too will be found out the only difference here is that you need to know a formula to calculate the password, that formula like the previous security problem is also saved on the device itself soo yeah not much of a solution if you ask me, though it does stop my current attempts at changing this to OpenWRT which I pretty much would love to do.

Any ideas on how to have this firmware upgrade done as I do have full access to the device and a nice networking set of tools I can use (my NAS and a few other bits and bobs to run temporary tftp servers for example).

Please help me ensure this poor poor piece of Zyxel hardware finally runs decent routing firmware, specifically OpenWRT!

Best regards,

If it really is a Keenetic Extra II, it is supported. I don't see any reference to a "D2000" anywhere.

Start here:

which leads to here which has install instructions:
This install is a rather simple boot into recovery mode and have it pull the file from your TFTP server. There is no need to use serial or to know a password.
The firmware files are under ramips/mt76x8.

Yeah, that won't really work with this firmware version. Need some flags enabled first.