Hacking into QNAP QSW-1105-5T (2.5G Broadcom-based switch)

Hi.

Does this model/series have full Luci access as the QNAP QSW-M1208-8C on port 8080?

Quote from the comment on Amazon:

If you connect to it out of the box, you get to set the root password, turn off the SSH port block and log in to the underlying linux OS.- From here, you can do anything * Install more software from the opkg repositories * Enable/Disable/Modify config params * Factory reset the unit / reboot, etc.-- all without knowing the admin set password on the documented web interface.

You can read the comment on Amazon here https://www.amazon.com/QNAP-QSW-M1208-8C-Managed-Switch-Gigabit/dp/B08JTZ79KT/

No. And I doubt it will ever have since it is based on Cortex M7 CPU which is more like the small microcontroller compared to A7 in M1208. The M1208 is sold as managed afterall.

1 Like

Hello everyone,
Sorry for bumping this old thread, but since I managed to soft-brick my QSW-1105-5T, this may be of some warning to other users.

I was messing around with VLANs but had to finish as I was about to leave my apartment. What I did was I set all 6 ports to VLAN 1 untagged, saved my configuration and next time I booted my switch it's stuck shortly after plugging the power. If I boot the switch with ethernet cable plugged in, respective LED remains lit even after I unplug the cable and if I boot without ethernet cable, plugging it doesn't bring LED up.

I connected to switch with serial connection using CH341A adapter and Putty software on Windows machine, but switch doesn't seem to accept any input - it's just like switch RX pin would be disconnected. As a result, I cannot interrupt autoboot procedure when Press any key to interrupt Auto Boot appears. Below is complete boot log:

BCM53158 SWITCH firmware Feb 22 2018
boot_src = M7. Initializing M7


Copyright 2015-2017 Broadcom Limited
         All rights reserved

Unit 0: ChipID: 53161 Rev 17
Unit 0: Straps: 00005041
Unit 0: PLL1 CH1 POSTDIV 13
LED Boot up -> 0s-3s
Unit 0: LED Refresh cycle config
Unit 0: LED Delay config
Unit 0: LED Strap load
Loading LED Firmware
.......
Unit 0: bootloader LED Start
Buffered Logs:


Broadcom ROBO OS Bootloader Version 2.3

Bootloader: QSPI flash Model: winbond Size: 128 Mbit

DEVFS: Initializing..
DEVFS: Device /dev/ttyS0 registered
DEVFS: Device /dev/flash0 registered
Press any key to interrupt Auto Boot
Autoboot starting...
Bootloader: Loading image at 1
Bootloader: Image Version SW-UT2205_1.00-0.05
Watchdog timeout value is 1250000000 (4a817c80)


Copyright 2015-2017 Broadcom Limited
         All rights reserved

ChipId: BCM53161 RevId: 17
Version Regs:
Software: ROBO_OS_REL_1_4_2 Build: Tue Jan 19 00:16:59 2021
MPU enabled
Unit 0: ChipID: 53161 Rev 17
Unit 0: Straps: 00005041
Unit 0: PLL1 CH1 POSTDIV 10
LED Boot up -> 3s-6s
Unit 0: LED Start
Buffered Logs:


Watchdog Setup with timeout 1250000000 (4a817c80)
Reading Primary Avenger OTP...
Starting Dynamic AVS Using ROs on Primary Avenger...
Applying Saved Core Voltage:9433 with saved DAC Code: 562.
dwl......avs.c:AvsSetDac=562, cur_dac=562 delta=0
........avs.c:SetPVTctrl setting AVS_PVT_MNTR_CONFIG_PVT_MNTR_CTRL from 0x80 to 0x180
SetAvsVoltage - Final Result: 1
Core Voltage After applying saved AVS results on Primary Avenger: 9430
cbxi_slictcam_init()
QSPI FLASH MPU region re-sized to 16 MB
sal_fs_init_all:114 File system initialized
sal_fs_init_all:122 File system obtained from TOC
sal_fs_init_all:128 File system initialized
cbxi_lin_init()
cbxi_encap_init()
cbx_port_init()
Unit 0 Mac init Ports: 8 9 10 11 12 13 14 15
cbx_lag_init()
cbx_port_create()
Unit 0: PBMP_ALL(unit)=ff00
cbxi_trap_init()
cbxi_stg_init()
cbxi_vlan_init()
cbxi_l2_init()
cbxi_mcast_init()
cbx_mirror_init()
cbx_meter_init()
cbx_cosq_init()
cbx_stat_init()
cbx_cfp_init()
cbx_auth_init()
cbx_link_scan_init()
cbx_link_scan_enable_set()
cbx_pktio_init()
------->cbx_stg_stp_set 1, 67108872, 3, 1
------->cbx_stg_stp_set 1, 67108873, 3, 1
------->cbx_stg_stp_set 1, 67108874, 3, 1
------->cbx_stg_stp_set 1, 67108875, 3, 1
------->cbx_stg_stp_set 1, 67108876, 3, 1
------->cbx_stg_stp_set 1, 67108877, 3, 1
LWIP successfully initialized
LBD enabled
LED Normal
Broadcom Cli Starting....

BCMCLI> Setting ip address to 1.1.1.100
<c=16781058f=port.cl=1392F=cbxi_port_speed_set>FSAL API : cbxi_port_speed_set()..phy read failed
<c=16781058f=port.cl=3261F=cbx_port_attribute_set>FSAL API : cbx_port_attribute_set()..Attribute set                            failed
<c=16781058f=port.cl=1392F=cbxi_port_speed_set>FSAL API : cbxi_port_speed_set()..phy read failed
<c=16781058f=port.cl=3261F=cbx_port_attribute_set>FSAL API : cbx_port_attribute_set()..Attribute set                            failed
STP can NOT enable when LBD has enabled.
STP can NOT enable when LBD has enabled.
STP can NOT enable when LBD has enabled.
STP can NOT enable when LBD has enabled.
STP can NOT enable when LBD has enabled.
STP can NOT enable when LBD has enabled.
LBD can NOT enable when STP has enabled.
uport = 0, fport=8, flow =0
uport = 1, fport=9, flow =0
uport = 2, fport=10, flow =0
uport = 3, fport=11, flow =0
uport = 4, fport=12, flow =0
uport = 5, fport=13, flow =0
uport = 10, tx pause =off
uport = 2, fport=10, flow =0
uport = 11, tx pause =off
uport = 3, fport=11, flow =0
uport = 13, tx pause =off
uport = 5, fport=13, flow =0
uport = 8, tx pause =off
uport = 0, fport=8, flow =0
uport = 9, tx pause =off
uport = 1, fport=9, flow =0
E_BI_CHK_INIT ... next 2
E_BI_CHK_LINK (0)... next 2
E_BI_CHK_LINK (0)... next 2
E_BI_CHK_LINK (0)... next 2
E_BI_CHK_LINK (0)... next 2
E_BI_CHK_LINK (0)... next 2
E_BI_CHK_LINK (0)... next 0

switch becomes stuck immediately after last line and stop ip/arp traffic ! never appears.

Even if I somehow manage to enter BCMCLI, I am unsure if there is a command to bring default configuration back as I am unfamiliar with this type of CLI.

Any form of help would be appreciated. If someone has an idea how to set switch back to default configuration, that should help me.

I have one more thought - if someone would dump working QSW-1105-5T flash, I have tools to program SOIC8 chip that this thing has, but @dtw github contains only 2204 dumps.

@Sacro did you managed to interrupt the bootloader? I bought different serial adapter (this time FTDI one) just to verify and using this one I am also not able to interrupt the bootloader.