Problem with modem in ZTE MF286R

How am I supposed to do that? I don't own the device and it's not available at all in my region. Let alone the fact, that there is an ath79 variant and mt7621 variant in the wild, with same appearance.

Hi. Just wanted to drop a message after seeing recent activity.

I own a ZTE MF286R for more than a year, and used it with my operator's(Turkcell) stock firmware, as well as some other vendor(TMobile poland) firmware i found on some random italian forum. It is overall a nice device, but stock vendor firmare I use is really restrictive, and the other vendor firmware does not work with LTE-A somehow so I reverted to stock firmware. I currently use it as a dumb AP, and did some googling on this device and a random blog post explaining an exploit which gave me telnet access on router. Then did some more googling and found -and read all messages on- this forum post.

In short I want to ask that if there's any intention to release openwrt for this device, and if there is, what's the progress, and is there anything I can do to contribute? (i'm not a developer or anything but i think i can pull off some technical stuff on this device if instructed)

ps: If I forget about this forum and for some reason and you really need to contact me, shoot me an email at But I'll check back in via mail notifs i guess.

What? MF286R is fully supported - router, modem etc. Just install and use it.

Are you sure, because I am sure I looked up "zte mf286r openwrt" multiple times today and past, and now too, and didn't see any. Also checked the official hardware table here but sadly couldn't see MF286R. Maybe you're talking about MF286D, a differrent device with differrent LTE modem.

I am sorry if it is something obvious that I can't just see..

PS: if it requires some compiling or something, I can probably pull that off, I don't really want to look like I am asking for too much. Just show me something to follow and I'll happily install and test everything

Yes, sure, I have one :slight_smile:


No, it doesn't require recompilation.

1 Like

OMG You made my day literally! Thank you so much, I'll (hopefully) install and use it when I'm back home. Thanks again.

Now I'm wondering why it's nowhere to be found on official hardware table or via google. Probably wiki needs updating or sth.

Also, after I test it a bit, I will probably publish this fw to the turkish forums where I know a lot of users of this specific box, mostly users of Turkcell Superbox service.

Thanks again. Really. cuz stock fw is bad, and turkcell fw is worse lol

For installation read

1 Like

I will check it out when I start installing the fw this night, I can't just pull it out at the moment until I put a replacement AP on the second floor for the meanwhile. Will probably come back here after install. Thanks

Hi. Uhh, I got the root shell, and backed up the original FW to a flash drive, then put firmware on another(both fat32). After issuing the nandwrite command, replacing the firmware mtd according to the cat output, I got this error;
hobb ss aldim 517

Since I already have the backups, I think i'll try the 3rd method.(edit: couldnt figure out how to "deliberately wipe the kernel") Any other suggestions?

Just power-cycling the router before another attempt should be enough - some process (possibly stock FW) may have locked some pages in that partition.
If this doesn't help then you can proceed with method 3. By "deliberately wipe the kernel" I meant using flash_erase command on that MTD node.

1 Like

Until now, nobody has created a dataentry for the MF286R. Without dataentry, it will not show up in the ToH.

If someone wants to create a dataentry: (need to be logged in to the wiki in order to access this page).

1 Like

Tried that, tried flashing t-mobile poland firmware via official tools(tmobile poland firmware DOES NOT have the url exploit one way or other) and back to turkcell, that didn't help either. I'll buy a TTL cable or borrow from my dormmates within today to trying again, just to be on the safe side.

I am willing to do that. I think I will also add a few extra stuff (like specifying flash_erase, fixing some places where it says mf286a, specifying which firmwares do and dont work with certain ways etc) and probably some more that I'll discover after booting the device with OpenWrt.

Followup: It was a piece of cake to install openwrt with a TTL adapter. I needed to install luci-proto-qmi packet after installing openwrt to use LTE modem, which I did via connecting to my wifi with the wifi radio. After that, everything seems like they should work. Thanks so much again

PS: seems like wiki does not accept outsiders to add stuff appearently, so I think I am unable to do what I said I'm willing to do.

Edit: Nope. I added the configurations to the etc/config/network and rebooted the device, but now it says device is not present. On the device, LTE light is up blue and signal bars are full, so the modem is online. Not sure what's going on. Will try some more stuff.

Edit 2: /dev output if that helps. No cdc-wdm0 that I could see here.


MF286R does not use QMI. MF286A does. Use NCM protocol and point the device at /dev/ttyACM0.
I think it's another good point to highlight at the wiki - because when support for both was added, modem part of MF286R wasn't ready yet - it was added a few commits later, after patches fixing some of its woes landed at the upstream Linux repositories.

@pcislocked for wiki access, see here: Applying for OpenWrt wiki account

1 Like

NCM worked for LTE, thank you again. I tested the speeds, wifi performance, vlan and such stuff. Seems like working as expected, although wifi is a bit slow to react to changes, it does work in the end, so I am thankful for at least having the advanced options.

Also, I created the techdata page and started to work on wiki as well, can't promise it will turn out perfect but it'll be something.

Finally, is there any option to specify/lock certain LTE bands, either via LuCI or ssh?

See here: :slight_smile:

1 Like

Stock firmware was up-to-date as it gets for my provider (A1 Croatia) and yes, the instability is related to the modem - if I remove the SIM and disable the connection, there aren't any reboots. Infuriatingly, modem crashes weren't in any way connected with the load or throughput - they occurred as long as the modem is connected to a network.

I used to get crashes with the original provider's firmware, only they were less frequent (once every few days, requiring a reboot) and the ISP's forum is filled with similar reports. They've switched back to Huawei for their CPE, with a good reason I suppose.

In any case, I anyone happens to have a newer firmware for it, I'd love to try it. Otherwise, I'll just use it as an AP/mwan/adblock gateway.

By the way, how come there is no VOIP support in OpenWRT?

I don't recall the telephone ports on those series to be VoIP capable - in MF286{,A,D}, these allow making/receiving voice calls through the cellular network. And modem handles this on its own, no intervention from OpenWrt is required.

Does stock FW allow configuring SIP connection instead of just CS voice? I recall, that on MC801A it was possible, but this is much newer product.

I honestly don't remember. If it didn't allow a VOIP configuration, I probably thought my provider deliberately hid those options from the user account as they usually do. I didn't think to check if the supervisor user had access to VOIP configuration options before I flashed.