Support for Cudy WR11000 (BE11000) v1.0

Hello guys.

I've bought one of the latest generation of Wi-Fi 7 routers: Cudy WR11000 (BE11000) v1.0.

This device uses the Qualcomm IPQ5322, which as of now is not supported by OpenWRT.

It'd be awesome to get OpenWRT running on this thing.

Device Name: Cudy WR11000 (BE11000)
Version: v1.0
SoC: Qualcomm IPQ5322 (Quad-Core ARM Cortex-A53, 1.5 GHz)
RAM: 512 MB DDR4
Flash: 128 MB NAND
Wi-Fi: Tri-Band Wi-Fi 7
Wi-Fi Radios: Integrated into IPQ5322
2.4 GHz: 2x2 MIMO
5 GHz: 2x2 MIMO
6 GHz: 2x2 MIMO
Ethernet:
1x 2.5G WAN
3x 2.5G LAN
Antennae: 6 external fixed high-gain antennas
Features: OFDMA, MU-MIMO, Beamforming, WPA3, VPN (WireGuard, OpenVPN, IPsec)

OEM Firmware
Official firmware is available here:

Board Photos
I will provide high-resolution images of the PCB (top and bottom), showing SoC, memory, flash, and any serial/UART headers.

Request:
Please consider adding support for the Cudy WR11000.

Ping me if you need something else or have something specific request in mind.

Thank you in advance!

Not how it works, someone who owns it have to do most of the work, and AFAIK QCA wifi7 support isn't nowhere near working.

Ok. Thanks for your comment. Is it a problem in general with Qualcomm chips or specifically with new one for wifi7?

With Qualcomm in general, if you want wifi7 any time soon, look at Mediatek.

1 Like

Do you think openWrt firmware could appear for my router in the next few years?

Technically, it could be never, if Cudy enabled safe boot, with signed firmwares.

Browse the firmware file and you'll find numerous references to OpenWrt. Apparently their version is based on a 21.02 snapshot. Meanwhile this is pretty far from an official support.

Sorry, I don't understand what you mean, because I can't find any connections between Cudy wr11000 firmware and OpenWrt. Maybe I looked in the wrong places. But I did made some investigation. It seems like the firmware contains ~18 certificates.
These certificates are likely used in a multi-stage verified boot chain, where each firmware component (e.g., Boot ROM, Bootloader, TrustZone, Kernel, etc.) is cryptographically signed and verified before execution. Used strong and modern signature algorithms: rsaPSS and sha256WithRSAEncryption. Sertificates issuers are: Qualcomm and custom internal CA names (e.g., SBL3, Attestation CA).
Basically, this router looks like it's locked down with a full chain of trust — from bootloader to kernel to rootfs — and each stage is likely signed and verified using certificates baked into the hardware (like QFuses if it's a Qualcomm chip). That means you can’t just flash a custom image like OpenWRT unless you have a way to bypass or break that chain, which is usually not possible without an exploit or leaked keys.
So yeah, chances are OpenWRT won't be coming to this device, unless something big changes or someone finds a vulnerability specific to this model.

Is it correct or I am wrong?

If the checks have been incorrectly implemented, it'd still be possible to boot a 3rd party images, like Openwrt.

It's happened before.

Just browse the file with an editor, and search for openwrt. By the end, you can even see 22.03 snapshot. Hence the Cudy firmware is based on an (quite old) OpenWrt custom version. This is also the case of many other devices.

This looks like an AI generated response...

Yes, it is. I have no background in IT—neither by education nor by profession—so AI helped me analyze the BIN file. It even created several Bash scripts for extracting certificates from the firmware and analyzing them. Based on the obtained data, it then made a conclusion about the likelihood of an OpenWrt firmware being created in the future for this router.

However, since I use AI in my own profession, I know that it sometimes makes incorrect conclusions. That’s why I shortened its conclusion and posted it here to hear the opinion of experts. :wink:

Yep, I found it, thanks. It just means the firmware is based on OpenWrt 21.02-snapshot, but that doesn’t necessarily mean a new OpenWrt build can be created and booted on the router—since it's protected with certificates, right?

1 Like

Find and browse the threads about other cudy devices: these can bring you usefull advices about how to proceed.

Also users have asked to Cudy for a signed version of OpenWrt. After installing this, you have control and can install your own build. You will also find interesting infos such as the dts.

AFAIK those signed images have always been created after the device had been added to OpenWRT, not before.

1 Like

For public availibility, yes.
But I do remember reading that users got images from Cudy.