toro
join:2006-01-27
Scarborough, ON
 ·TekSavvy Solutions..
| [Equipment] WRTP54G-ST
For the fans of the Linksys VoIP hardware: there's a new model of WRTP54G out there, called WRTP54G-ST (that's what the firmware shows, the bottom sticker says "WRTP54G Ver 2"). I just got one and haven't found much info about it, so I decided to start a thread myself.
It's made for Sprint, although I don't see much stuff on the Internet about consumer VoIP services offered by Sprint (or maybe it was a project that went dead before launching ?).
Anyways, here's what I found within the first half hour of playing with it:
The hardware is slightly different than WRTP54G v1 and v1.1. The mini-pci wifi card is gone and everything is onboard. It has a serial console and probably a JTAG (well, at least it looks like one, I haven't tried to hook it up yet). The JTAG has the pins installed. The rest of components are the same, meaning the same Texas Instruments CPU, same Infineon switch and Legerity VoIP chipset. The only thing different is the WiFi chipset: on the old routers the card had a TNETW1130ZVF while the new chipset is TNETW1350A.
I'll take photos of the hardware later and post them if anyone is interested
The firmware shows version 0.00.39. I assume since it's a new hardware, it doesn't relate to the versions made for the original hardware. The /Voice_adminPage.html and /Provision.html URLs work. Even more, the factory Admin password is "Admin" (verified also through the environment variables). The Administration web page allows one to enable SSH, and the login works with Admin/Admin. The console state is set to locked initially, but it can be easily changed once you logged in via SSH, using
One strange thing is that the factory set provisioning URL is something like https://192.168.15.100/001839AABBCC.xml
I don't get why 192.168.15.100 since that's a private IP in the router's DHCP range.
The environment contains the usual HASH_DIR, CRYPT_KEY and ADMIN_PWD found in the Fonage version of the router. In my case, after I unlocked the console through SSH, I was able to delete the HASH_DIR and CRYPT_KEY variables to prevent any accidental provisioning. The ProductID is set to CYSW. There's a bunch of new environment variables, labeled WLAN_EEPROM0 through WLAN_EEPROM14 which show some long hex strings. |
|
mazilo
From Mazilo
Premium
join:2002-05-30
Lilburn, GA | Interesting. Where did you get the device and how much did you pay for it? |
|
toro
join:2006-01-27
Scarborough, ON | reply to toro
eBay / $35 |
|
mazilo
From Mazilo
Premium
join:2002-05-30
Lilburn, GA | reply to toro
Thanks for your quick response. I wonder how much Linksys sells this device for, i.e. $160? |
|
mazilo
From Mazilo
Premium
join:2002-05-30
Lilburn, GA
| reply to toro
You probably bought this device from here. I am tempted to order one. However, I am more inclined to get the WRTU54G for T-Mobile mainly because it comes with a 64MB RAM. |
|
mazilo
From Mazilo
Premium
join:2002-05-30
Lilburn, GA
| reply to toro
Here is an old post about this device where the OP was looking where to download its firmware.
BTW, you said your device isn't locked. R U sure? Can you perform a factory reset to see if it will get relocked? |
|
toro
join:2006-01-27
Scarborough, ON | I did a factory reset already before starting the thread and the Admin password stayed the same. That's because it's set to Admin from the main environment variables. |
|
mazilo
From Mazilo
Premium
join:2002-05-30
Lilburn, GA
| said by toro  :I did a factory reset already before starting the thread and the Admin password stayed the same. That's because it's set to Admin from the main environment variables. Excellent. Apparently, a google search shows many of this device sold @ around $35/each. |
|
Dave67
@cox.com | reply to toro
Toro,
Are you saying that the console unlock step will open the SIP provisioning area in the GUI? I have had this thing for several months and have tried everything to hack into it unsuccessfully. |
|
toro
join:2006-01-27
Scarborough, ON
·TekSavvy Solutions..
| Yes, on mine the Admin password was set by default to "Admin" and it stays like that after a factory reset (BTW, have you tried to reset yours by holding the reset button for about 8 seconds ?).
I was able to get in through the serial console and SSH using the username Admin and password Admin.
And I can access all the SIP and provisioning settings like on a fonage router, using the /Voice_adminPage.html and /Provision.html URLs.
What is the firmware version on yours ? Has it ever been used with any VoIP service ? |
|
