Zyxel EE5301-00 Wi-Fi 7 Router

For Developers
1

I got my hands on this Zyxel EE5301-00 Wi-Fi 7 dual-band BE7200 router with 10G/2.5G WAN and LAN, an SFP+ cage, and support for EasyMesh and TR-069/TR-369, i wonder will it ever be Openwrt for it.

00
001129×1269 175 KB

[grid]

01
011200×1600 163 KB

03
031200×1600 177 KB

05
051600×1200 211 KB

From the bootlog, it appears to be based on the Airoha/Econet EN7581 platform, with a 4-core ARM64 CPU, around 1 GB RAM, 512 MB SPI-NAND, MediaTek Wi-Fi 7 radios, dual firmware slots, and Zyxel’s signed zloader boot chain.

uart
uart1329×917 202 KB

Serial console:
115200 8N1 works.
Boot can be interrupted at Zyxel zloader v2.8.6, but zloader asks for a password.

set mac reg init
usxgmii_pcs_int en 1
USXGMII_10G exit
read: src=0x60000, len=0x20000, dst=0x81800000
bootm flag=0, states=70f
## Loading kernel from FIT Image at 81800000 ...
   Using 'config-1' configuration
   Verifying Hash Integrity ... sha1,rsa2048:zloader_key+ OK
   Trying 'zloader' kernel subimage
     Description:  zloader
     Type:         Standalone Program
     Compression:  lzma compressed
     Data Start:   0x818000d0
     Data Size:    18457 Bytes = 18 KiB
     Architecture: AArch64
     Load Address: 0x81700000
     Entry Point:  0x81700210
     Hash algo:    crc32
     Hash value:   1426c139
     Hash algo:    sha1
     Hash value:   6750e14d7fb753e5957cdc6d950f1b00743195f3
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Uncompressing Standalone Program ... OK


ZYXEL zloader v2.8.6 (04/22/2025 - 10:24:50)
!!! Initialize nand !!!
Multiboot clinent version: 2.8

Hit any key to stop autoboot:  5
Password:

The sticker admin password allows login, but only to restricted ZySH

z
zycli help
wan
ethwanctl
dns
pppoectl
sys
tr069
wlan
mgmtsrvctl
virtualserver
cfgupdate
cfgdump
save_default
fwidcheck
modelcheck
reboot
i2c
sfp
swversion
swarchversion
Ethctl


z sys
Usage: sys help
       sys show
       sys atsh
       sys atsn <SeriesNumber>
       sys atwz <MAC> <CountryCode> <EngDbgFlag> <FeatureBit> <MacNumber>
       sys atcd Erase ROM-D partition.
       sys atcr [reboot] Reset to default, erase Data partition.
       sys atgs <GPONVendorID> <GPONSerialNumber>
       sys --autogenpwd <enable>
       sys --autogenpwd <enable> <prefix>
       sys --autogenpwd <disable> <password>
       sys --autogenpwd show
       sys --WPSbtn <enable>
       sys --WPSbtn <disable>
       sys --WPSbtn show
       sys seqnum [1|2]
       sys getbootpartition
       sys nonboot
ZySH>

The device as zyxel,ee5301-00 and the SoC is econet,en7581 / airoha,en7581.

bootloader      0x00000000  size 0x00080000
tclinux         0x00080000  size 0x03c00000
tclinux_slave   0x03c80000  size 0x03c00000
rootfs_data     0x07880000  size 0x00800000
romfile         0x08080000  size 0x00240000
rom-d           0x082c0000  size 0x00240000
wwan            0x08500000  size 0x00200000
data            0x08700000  size 0x00800000
zyMFG           0x08f00000  size 0x00200000
misc            0x09100000  size 0x12b80000
art             strange / needs care

The device appears to use the Airoha/Econet EN7581 platform with Zyxel’s zloader boot chain and signed firmware images. There is currently very little public documentation about this platform, so community research and shared findings are important for making proper OpenWrt support possible.

2

You could try mtk_uartboot, but I'm not sure if the files required for it are built for your arch, if not, zyeng https://github.com/ndandanov/zyxel-ex5601-t0-openwrt/blob/main/guide/guide.md.

3

I can say for sure that "zyeng " is not possible engineering/debug access is probably disabled

For mtk_uartboot on EE5301, I would not expect to work directly untill recompile for the board.

Here is why

This SoC is Airoha/Econet EN7581 / AN7581. mtk_uartboot is for MediaTek ARM SoCs using the MediaTek BootROM UART download protocol.
Even this chip is actually related because Airoha/Econet and MediaTek ecosystems overlap, but the bootlog and DTS identify it as:

econet,en7581

airoha,en7581

AN7581/EN7581 naming is Airoha/EcoNet, not plain MT762x/Filogic.

So in my view mtk_uartboot is worth testing but i dont expect success.

I am working on firmware data i ll post some findings.

4

mtk_uartboot won't work on an7581. That soc has it's own recovery method described here:

Please note, that method only works if the reset button (or any other button) is wired to gpio0

But first you need to check out, if atf/u-boot is enforcing secure boot.

If so, you would need a signed fip image.