Flash on Zyxel NR7101

Hi all,

I also went the route of getting a used Telenor branded nr7101. I have gotten the supervisor password and a serial console, removed the iptables rules to enable access to the webinterface. However Im having issues logging into the web interface. Neither admin/supervisor/root work with the supervisor password or the default "1234".

Peeking into /data/zcfg_config.json seems to show that the supervisor and admin account is disabled - and no password set for the root account.

Any idea on how to get access to the web interface? Can i update the /data/zcfg_config.json to enable the admin account and set a password?

Will the passwords be reset to a known default if I manually flash the stock fw, either by adding it to the /root/fw directory or performing the procedure in the wiki?

> "Account":[
>           {
>             "AutoShowQuickStart":false,
>             "Enabled":true,
>             "EnableQuickStart":false,
>             "Page":"",
>             "Username":"root",
>             "Password":"",
>             "PasswordHash":"", 
>             "Privilege":"login",      
>             "AccountIdleTime":900                                 
>           },                 
>           {
>             "AutoShowQuickStart":false,
>             "Enabled":false,
>             "EnableQuickStart":false,
>             "Page":"",
>             "Username":"supervisor",
>             "Password":"",
>             "PasswordHash":"",
>             "Privilege":"login,httpd,samba",
>             "AccountIdleTime":900
>           }
> 
> {
>             "AutoShowQuickStart":true,
>             "Enabled":false,
>             "EnableQuickStart":true,
>             "Page":"Broadband,Wireless,Home_Networking,Routing,NAT,DNS,IGMP_MLD,Vlan_Group,Interface_Grouping,Firewall,MAC_Filter,Certificates,Log,Traffic_Status,ARP_Table,Routing_Table,CellWan_Status,System,User_Account,Remote_MGM
>             "Username":"admin",
>             "Password":"",
>             "PasswordHash":"",
>             "Privilege":"login,httpd,samba"
>           }
>         ],

Update:
I booted the stock firmware from RAM using the TFTP procedure in the wiki. That allowed me to login using supervisor and the generated password (same as for SSH). I then added a new administrator account to the web interface, flashed the stock firmware from the web interface. This has left me with full access to the device. If you want to add a user to the web interface directly in the zcfg_config.json this is a working format for NEWUSERNAME/Abcde123

{                                       
            "Enabled":true, 
            "EnableQuickStart":true,
            "Page":"",   
            "Username":"NEWUSERNAME", 
            "Password":"_encrypt_qRHR47FeuZNpaAD75lAhdA==",
            "DefaultPassword":"_encrypt_qRHR47FeuZNpaAD75lAhdA==",
            "DefaultGuiPassword":"",        
            "ResetDefaultPassword":false,
            "shadow":"",       
            "smbpasswd":"",           
            "ConfigAccountFromWAN":false,  
            "PasswordHash":"",     
            "DefPwLength":8,       
            "AccountCreateTime":0,        
            "AccountRetryTime":3,
            "AccountIdleTime":300,   
            "AccountLockTime":300,      
            "RemoHostAddress":"",   
            "DotChangeDefPwd":true,
            "ShowSkipBtnInChgDefPwdPage":false,
            "AutoGenPwdBySn":false,
            "AutoShowQuickStart":false,
            "Privilege":"_encrypt_YGgzSKoZTnvsKEsFYUG4fgR2cLz+zcudbgkKsNq5fVc=",
            "RemoteAccessPrivilege":"LAN",
            "OldDefaultPassword":"",
            "CardOrder":"",            
            "ThemeColor":"",
            "HiddenPage":"",       
            "SshKeyBaseAuthPublicKey":"",
            "GetConfigByFtp":false 
          }