OpenWrt for Zyxel WSM20 (Multy M1) development discussion

WARNING: If you need any clarification installing or configuring your ZyXEL WSM20, please ask here:

And not on this current topic which is meant exclusively for development purposes.

I've added the WIKI page also with all the information we will be finding in this thread:

Already available to download in the latest snapshots:

Installation from ZyXEL UI: zyxel_wsm20-initramfs-kernel.bin

Installation instructions:

  1. Log into the OEM web GUI
  2. Access the hidden upgrade page by navigating to
  3. Upload the -initramfs-kernel.bin file and flash it
  4. Wait for OpenWrt to boot and log in via SSH
  5. Transfer the sysupgrade file via SCP ( by OpenWrt default)
  6. Run sysupgrade to install the image
  7. Reboot and enjoy

Upgrade from OpenWrt: zyxel_wsm20-squashfs-sysupgrade.bin


opening of the case
side above
unclip at the back with an object like a mediator


serial port 115200 -> 3.3volts nothing, white RX -> TX , green TX -> RX , black GND

Startuo log

You can interrupt startup with f key ( not found login / password )

Loading from nand0, offset 0x2c00000
Fit image detected...
FIT description: MIPS OpenWrt FIT (Flattened Image Tree)
Image 0 (kernel@1)
Description: MIPS OpenWrt Linux-4.4.198

U-Boot 1.0.3 (Jul 29 2021 - 06:23:57)
CPU: MediaTek MT7621AT ver 1, eco 3
Clocks: CPU: 880MHz, DDR: 1200MHz, Bus: 220MHz, XTAL: 40MHz
Model: MediaTek MT7621 reference board (NAND)
DRAM: 256 MiB
NAND: 128 MiB

This is definitelly great

U-Boot 1.0.3 (Jul 29 2021 - 06:23:57)

CPU:   MediaTek MT7621AT ver 1, eco 3
Clocks: CPU: 880MHz, DDR: 1200MHz, Bus: 220MHz, XTAL: 40MHz
Model: MediaTek MT7621 reference board (NAND)
DRAM:  256 MiB
NAND:  128 MiB

Maybe just with such user and password we could be sysupgrading straight from the U-Boot.

What happens if you interrupt with f

Can you send help command?

Is there anything in the NWA50AX Wiki that can help?

Post the output.

1 Like

interrupt uboot, post the output from help, and printenv.

FYI I've requested the M1 specific posts to be split from this thread, they're off topic.

It's true, but it would be great to know more about all the specs as in the ToH

I would say:

Bootloader: U-Boot 99,99%
Flash: 128Mb???
RAM: 256Mb???
Ethernet ports (100mb/1Gb): 1 WAN Gb and 3 LAN Gb

For me it looks the best future proof budget solution so far.

With the hype I'm seriously tempted on purchasing the pack of 3. They are absurdly cheap. Almost the same price as the shitty TP-Link TL-WR741 4/32 but we are talking about a killer AX1800 that may probably blast 90% of the current's ToH inventory (at least for a Dumb AP).

Given that 99,99% of the components have been already developed, only would like to see if the U-Boot can be halted and if it has some convenient way of flashing other than straight from UART (for dev is fine but for daily driver is a pain in the ass for me). But it seems that OEM factory images could be uploaded straight from Zyxel interface, which makes this amazing.

Also note that ZyXEL NR7101, NWA55AXE, NWA50AX has the exact same software and all three support 22.03.3

Also ZyXEL NR7101 is an amazing piece of hardware, which gives me some extra confidence on this budget APs.

1 Like

the boot log should reveal most of this, unless the output's supressed.

you could also see if you can find the info based on the markings, on the chips, on the PCB.

1 Like

Dude, I've bought the pack out of pure hype. I've been reviewing hardware specs and for $20-$25 per unit, it's crazy!

As soon as they arrive i'm going all in :slight_smile:

Anyway, to avoid keep on going on dev topics for this device, I've opened a more appropiate thread.

@Annick interrupt earlier, try hard reboot of the Zyxel and keep pressing ESC or space way way earlier in the uboot process.

or keep pressing the reset or WDS button while power it on, and watch the serial while doing so.

1 Like

@Annick if you unplug GND just after boot can you interrupt uboot?

I had an issue on the belkin rt1800 where I had to boot with GND unplugged and attach GND afterwards to break into uboot

You are not in bootloader, you are straight with that ZyXEL custom OpenWRT fully loaded.

I believe that you need to interrupt bootloader within the first second of loading. You can just reboot from OpenWRT and then start pressing keys like mad (possibly ENTER)

Can you check if sysupgrade command works within that custom OpenWRT?

In failsafe ode ( key f ) i can run sysupgrade & mtd

dev:    size   erasesize  name
mtd0: 07f80000 00020000 "All"
mtd1: 00100000 00020000 "Bootloader"
mtd2: 00100000 00020000 "Ubootenv"
mtd3: 001c0000 00020000 "Factory"
mtd4: 02800000 00020000 "firmware_now"
mtd5: 00380000 00020000 "kernel"
mtd6: 02440000 00020000 "rootfs"
mtd7: 02800000 00020000 "firmware"
mtd8: 00100000 00020000 "persist"
mtd9: 00400000 00020000 "rootfs_data"
mtd10: 025c0000 00020000 "app"
mtd11: 00100000 00020000 "crt"
mtd12: 02800000 00020000 "RAS1"
mtd13: 02800000 00020000 "RAS2"

Too bad there is no USB

Problem is login & password in not failsafe mode

This is more than enough.

Now its time to develop a firmware.

It would be great to find a TFTP in case we screw and brick the device

Will need to try the classic TFTP setups

still think you should check if the external buttons trigger some kind of recovery, then you wouldn't need to open the device for flashing.

try another usb adapter or check the cable, or play with tx and rx

I assume there's output, but u-boot ignores the buttons ...

If he has the right output in the COM why do you think that playing with TX and RX would be a thing?

Why would you interrupt the output if he already can access failsafe mode? There must be a TFTP already running from there.

Can you do a ps to see which processes are running in failsafe?

Not what I'm saying/want.
I want to try to trigger a recovery w/o opening the device, but it seems to be a dead end.

If you're already in openwrt, there's no TFTP, TFTP is used by uboot, if you can figure out the access.