Hi, first time poster here, Iets get right to it ! I got a router from my isp and bought it instead of having to pay per month to keep it and tough I would get openwrt on it (only prior experience is installing dd-wrt on a lynksys ea6900). Its a ZyXEL EMG2926-Q10A wich according to some article is simply a rebranded ZyXEL NBG6716 wich is compatible with openwrt (wiki.openwrt.org/toh/zyxel/zyxel_nbg6716 (sorry can't post link))

My problem is that its complettly locked, the firmware can't even be updated from the webgui at all ! so I dug  a little deeper, connected a usb to ttl cable to the router and got acess to the consol. after that I got nothing, all the guide I found for this particular model that are locked by the isp tell me to stop uboot from loading the firmware by pressing a key when uboot say "Hit any key to stop autoboot:" but that as apparently been disable as this prompt never come up, it start booting right away (tried ctrl-c as some guide recommended but not working either).

so I let it boot and completly and got to the point where I got a login prompt after pressing enter and after mutch screwing around, found the root password (yeah I guess ? ). After that I tried to change uboot parameter to set the bootdelay to something other then 0 and failed because it seem /dev/mtd1 (where the env is suposed to be acording again to many guide) is read only.

so thats the whole story, anyone got any experience with this ? google is not helpfull at this point and my knowledge of linux is limited to installing it on a laptop and messing around with a couple raspberry pi.

It seems they are two different products. They might have the same hardware, though.

ftp://ftp2.zyxel.com/NBG6716/datasheet/NBG6716_3.pdf
ftp://ftp2.zyxel.com/EMG2926-Q10A/datas … Q10A_1.pdf

You can access the Linux console through the serial port using the same credentials that you'd use with the web administration interface. This account is not a root-level account, though, so you can't do much.

Try to record the bootlog through the serial console, and post it into pastebin.

The account I am talking about IS the root account, that I am sure (please reread what I wrote, I clearly said it was the root account)

The way I got acess to it is actually pretty funny : by reading the boot log,I found that the router run a script called "password" that, it seem, is only used to reset the password of 2 account on boot, one called "administrator" that I could not guess(no its not the same as the "admin" account used to log in the web interface), and one called "supervisor". when the script run it say "Changing password for supervisor" then it say "warning : password simmilar to username" and the script continue ! so at the prompt I entered supervisor as the account and supervisor as the password and it loged in (yeah simple as that). I then tried to change the root password (wich I didn't know at the time) using the passwd command and was able to change the root account password. i then loged back with the root account and got acess to everything, thats where I was when I wrote the previous post.

Then after a bit of googling that returned nothing I decided to try what was written on the wiki I posted (and yep , it is "suposed" to be 2 different model but the internal hardware is exactly the same (according to a few google post and after comparing picture of the inside) , they just changed the faceplate and renamed it). connected the router to the internet, used wget to dowload openwrt Chaos Calmer (15.05.1) for the NBG6716 and then used that command :

mtd -r write openwrt-15.05.1-ar71xx-nand-nbg6716-squashfs-factory.bin /dev/mtd7

and got an error message telling me that the firmare was not compatible with that device (since it was named EMG2926). Since after my research I was sure that it was indeed a NBG6716 I used the -f paramter to force the flash (I know the risk, but as I said I was SURE it was a renamed NBG6716) and it completed the flash without any other warning. After a reboot (wich was way way way faster then with the stock firmware) I was greeted by the openwrt logo and unde it it was written "Chaos Calmer (15.05.1)" and after login the prompt was now root@NBG6716 instead of root@EMG2926 ! woohoo.

I then put the router back together, connected it to my pc and to the internet and loaded the web interface and it worked, configured everything and been testing it since then, everything work perfectly and way better then before, also got acess to many option that where locked in the stock firmware. so a good learning experience, and hoping it may help someone with the same problem.