ZTE G5TS: Gaining Access to Hardware/OpenWRT

Hardware Questions and Recommendations
1

Hi!

Aldi Talk, a supermarket mobile provider, sells the ZTE G5TS at a low price. I became interested in it and bought two because ZTE advertises that it runs OpenWRT. This has been discussed here: Possible GPL violation: ZTE G5TS.

Unfortunately, it looks like the router software is mostly locked down, and there is no way to gain root access to manage OpenWRT.

I have already opened the router to check for UART access. However, it does not have the same pins as the ZTE MF289F. It's worth noting the ZTE USB-C port, which seems to be for "their tools" only. I have not been able to use it yet.

My next plan is to ask ZTE support and ask you. Does anyone here know how to gain access to the terminal?

Bought here: https://www.alditalk.de/p/router-zte-stationarer-router-g5ts-5g-wei-30040908A1

Teardown:

Pictures of the Inside:

Frontside with Heatsink
Frontside with Heatsink1920×1920 386 KB

Looks like I cannot post more than one picture as a new member. I will try to post them in the future.

Kind regards!

1 Like
2

Backside
Backside1920×1920 507 KB

3

Did you gain any more information? Seems to be a potential interesting product, if we can access it, and it actually is OpenSource...

4

The ZTE support responded:

English (Translated):

There is no official way to install your own OpenWrt image on the ZTE G5TS model. Telnet or SSH access is also not supported in the standard firmware.

You can download the source code for the OpenWrt-based components of the firmware from the ZTE open source website:
https://opensource.ztedevices.com

German (Original):

Für das Modell ZTE G5TS gibt es keine offizielle Möglichkeit, ein eigenes OpenWrt‑Image zu installieren. Ebenso werden Telnet- oder SSH-Zugänge in der Standard-Firmware nicht unterstützt.

Den Quellcode der OpenWrt-basierten Komponenten der Firmware können Sie über die ZTE Open-Source-Webseite herunterladen:

https://opensource.ztedevices.com

The response is very disappointing, especially given that it appears to have been generated by ChatGPT (their URL includes ?utm_source=chatgpt.com). There's no name below either, so it might be an automated reply.

From the provided link, we can find the source code and open-source notice.

5

Unfortunately, the source code has been heavily stripped down, making it pretty much useless. There is also no option to upload firmware via the web interface.

Web Interface:

Login Page
Login Page2560×1440 59.6 KB

Main Page
Main Page2560×1440 111 KB

A cURL copy of a request sent via the web interface to the Ubus.

curl 'https://10.10.10.1/ubus/?t=1770430916243' \
  -X POST \
  -H 'Z-Mode: 0' \
  -H 'Z-Tag: nwinfo_get_netinfo' \
  -H 'Cookie: webtoken="REMOVED"' \
  --data-raw '[{"jsonrpc":"2.0","id":13,"method":"call","params":["00000000000000000000000000000000","zte_nwinfo_api","nwinfo_get_netinfo",{}]}]'

[{"jsonrpc":"2.0","id":13,"result":[0,{"net_select":"Only_5G","net_select_mode":"","network_type":"NO_SERVICE","domain_stat":"","signalbar":"","simcard_roam":"","wan_active_band":"","rmcc":0,"rmnc":0,"network_provider":"","network_provider_fullname":"","cell_id":0,"lte_pci":0,"wan_active_channel":0,"lac_code":0,"ltecasig":"","lteca":"","nrca":"","lteca_state":0,"lte_neighbor_cell":"","nr_neighbor_cell":"","lock_lte_cell":"","lock_nr_cell":"","lte_band_lock":"0x7a0880800c5","gw_band_lock":"0x000000000","lte_band":"1,3,7,8,20,28,32,38,40,41,42,43","nr5g_nsa_band_lock":"","nr5g_sa_band_lock":"1,3,8,28,41,77,78,7,20,38,40,75","nr5g_nrdc_band_lock":"","nitz_sync_flag":0,"nitz_timezone":"","nr5g_rsrp":0,"nr5g_rsrq":0,"nr5g_snr":"","nr5g_rssi":0,"lte_rsrp":0,"lte_rsrq":0,"lte_rssi":0,"lte_snr":"","rscp":0,"rssi":0,"ecio":""}]}]

The USB port reports as:

[11724.579802] usb 3-4: new high-speed USB device number 6 using xhci_hcd
[11724.705288] usb 3-4: New USB device found, idVendor=19d2, idProduct=1225, bcdDevice= 1.01
[11724.705293] usb 3-4: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[11724.705296] usb 3-4: Product: DEMO Mobile Boardband
[11724.705298] usb 3-4: Manufacturer: DEMO,Incorporated
[11724.705300] usb 3-4: SerialNumber: 1234567890ABCDEF
[11724.707692] usb-storage 3-4:1.0: USB Mass Storage device detected
[11724.707814] usb-storage 3-4:1.0: Quirks match for vid 19d2 pid 1225: 1
[11724.707841] scsi host6: usb-storage 3-4:1.0