New ONT AOT-5221ZY

[singhz4u]

I need to check the config cause my plan is to use it as wired extender as I have spare ZTE F670L router and I know a trick to get gigabit speed.

 

[tr1k0N4]

What kind of a trick is that, brdr

 

[singhz4u]

My plan is to clone the serial number of the AOT5221ZY router onto a ZTE F670L, which will act as the primary router in my network. By doing this, the ZTE router will be recognized just like the original AOT5221ZY, allowing me to manage WAN settings freely. I’ll make some configuration tweaks in the WAN setup that are known to unlock gigabit-level speeds. The AOT5221ZY will then be repurposed as the first wired extender, connected directly to the ZTE F670L. On the first floor, I’ll place a TP-Link Archer AX10 as the second wired extender, also connected via Ethernet. This entire setup should provide me with full control over the network, better performance, and reliable gigabit speeds

 

[tr1k0N4]

Interesting! I wonder all steps does it involve

 

[IfranAli]

@singhz4u AOT5221ZY is locked to the core, even DHCP won't turn off.
I would say better to use the ZTE as the primary router, and keep the ZyXEL off-limits.

 

[singhz4u]

I’ve already tested connecting the fiber cable directly to the ZTE F670L, and it delivers 1 Gbps speeds without any issues. Now, I’m looking for a way to repurpose the AOT55221ZY as a wired extender or just unlock it and edit wan connections and tr069.

 

[IfranAli]

You need to first unlock the romfile.cfg, for that, an SPI-NAND dump is needed.
After decryption, check for any anomalies and telnet/ssh

 

[singhz4u]

I’ve successfully extracted the romfile.cfg from the router using Gemini and ChatGPT. However, I currently have no idea how to decrypt it. @IfranAli do you know the decryption process?

 

[RKhan21]

@singhz4u what trick?

 

[IfranAli]

@singhz4u I think it's decryption requires some sort of "key", which needs a firmware dump.
If you can dump the fw via SPI flashing, go for it.
I also did download the romfile.cfg, waay back when I first got it. But it seems like it's not the correct one/it's not what we are after