Good afternoon, I got this NR7101 ex Telia, managed to get the root password and all the rest, my intention was to update the stock software or maybe try ROOter, and to have the possibility to install Quectel firmware different from the custon ones provided from Zyxel.
I started trying to get a backup of the installed router firmware, 1.00(ABUV.6)F2 version, but I noticed it was behaving weirdly: connected to the console, I could not stop the boot at all, using esc and any other kind of key combinations found on internet. The other weird thing was that I could not copy anything on the /temp folder, using both filezilla and winscp it was literally kicking me out of the connection, and then connecting again, in a loop without any good outcome.
Nevertheless, from the GUI I was still able to update to the last stock firmware available 100ABUV11C0 and to update to the last spec the modem RG502QEAACR13A04M4G_ZYXEL_01.200.01.200 available on Zyxel website.
Everything is working now, but it's still basically locked, still with the same limitations about the possibility to replace the firmware. Is there any possibility to overcome this lock? Anything that I can check?
I was fearing this reply! 
But you confirm that a lock can work this way, and not a faulty hardware? I don't have a wide experience, but something like this was really not considered, when I think about something locked by a vendor, I think of a device that doesn't allow any modification in order to prevent the user to use it with another mobile operator. I can't really say this is the case, so my doubt was also about if there is something wrong.
@bmork would probably know better, but stock fw's can be crippled in many ways.
Thank you anyway, of course any input from @bmork is very welcome.
I have seen he did a great job on these models, unfortunately these workarounds require some level of expertise on linux and on router hardware and cannot be defined basic user friendly.
I have seen that in northern Europe many of these devices have been dismissed from their FWA original use, and it's a pity that such a still valid cpe is going to become just electronic waste because of a locked software.
there's Method to flash any NR7101, but I don't know if it's detailed enough for you.
IIRC, setting the DebugFlag also unlocks bootloader access on these devices. You can do that from the vendor firmware using the commands given here:
(The reason I recommend "0x1" instead of a simple "1" is that the firmware I had would test for exactly "1" at boot and always reset it to "0". While everything else seems to treat "0x1" and "1" as equal)
Thank you, but is this only part of the problem, I assume, or has it any influence on the fact that I cannot upload anything on the folder /tmp ? Are the two things linked?
No, I don't think that's related. I just assumed that was because you mis-spelled it "/temp" 
I don't know about filezilla and winscp, but newer scp versions defaults to a new protocol variant ("sftp") which isn't supported by most OpenWrt or vendor firmwares. There's a "-O" switch to make the command line scp application switch back to the older "scp" protocol. Maybe the same issue, and a similar solution, applies to filezilla and winscp also?
OMG, you just lighted the fact that I have been using alternatively the wrong program and the right program with the wrong protocol. Of course now it is working with WinSCP.