Instanet Router Hacking

ZTE-IX350 Router
I am using Instanet as my ISP here in Spain. Instanet makes use of WiMAX internet technology, which allows you to have a mobile broadband connection much like WiFi without renting expensive telephone lines. The modem itself is a ZTE IX350, which essentially functions as a router combining WiFi and 4-port 100Mbps ethernet connection. My flat rental manager gave me two modems in exchange for reactivating the usual broadband connection as the previous tenant didn’t pay his/her last bill.

Since I have two modems, it is only natural for one to want to combine the bandwidth into a single connection; for this purpose, my other OpenWrt-based router will come in handy. Alas, the device settings on the modem are protected by a password. Worse still, it is not the usual or default username and password (admin:admin) combination but in fact different with each modem that is given to the consumer. Fortunately though, there is a way to obtain the password! We can do so by accessing the serial port of the modem using a USB-Serial adapter.

However, in order to perform this hack, it is necessary to have a basic electronic skill such as soldering and making connections to the PCB.

First, open up the router by removing the front black plastic cover. On each corner there will be 4 ordinary phillips screw. Be careful not to damage the internal WiMAX antenna connections. Access to the serial port is provided by unpopulated jumper connector indicated by X17. Pin 2 is TX, pin 3 is RX and pin 4 is GND. See the image below as a reference.

Serial port on the ZTE-IX350 WiMAX modem

Serial port on the ZTE-IX350 WiMAX modem

After you’ve done it, connect to the port using a USB-Serial adapter and fire up your serial terminal, for example Putty, and set the connection setting for the serial port to be 115200 N8. Turn on the modem, and you’ll see typical Linux kernel initialisations and stuff. After the messages finished updating, press Enter and voila! You are given a root [!] shell.

To get the admin password for the web interface, type this command into the shell:

cat /etc_rw/param/inic_param

Router Password

Et voila! There’s your admin password! Now you will able to enter the web interface on (the default IP of the modem) using it.

You may also like...

  • alex

    The pins are 5V logic or RS-232 bipolar levels?

    • I suppose it is a 3.3v one. I was using a CP210x USB to UART converter and it can work on both 5v and 3.3v.

      • alex

        right now i finished my connections but i don’t know the encoding. UTF8 is giving erroneous symbols. I will try another baud for now.

        • What terminal are you using? For Windows, I suggest to use Putty, or in Linux, try screen. There’s no need to specify any encodings.

          • alex

            It’s putty, i think the problem is baud rate because i get something like bootscreen. I’ll try more baudrates for now…

          • Ok. Good luck!

          • Alex

            So, the baud is 38400, 8 bit everything normal. But it asks me to login!

          • Ah, too bad. Maybe you can try the usual combinations? 😀 Otherwise there’s not much else that can be done…

          • Philgood

            Hello. I’m trying actually the same like Alex with the ix380 model. I hope it will get me to the root prompt like in the case of the ix350. Can you say me where to connect the serial lines at this specific model ? (ix380) In absence of a USB-serial converter, do i have to worry about voltages for the connection to the com-port of my computer ? Gracias.

          • Unfortunately I do not possess the ix380, so I can’t tell you where the exact location of the serial lines. However, close to the main processor there usually is a row of (un)populated pin header where such connection might exist. As you don’t have the usb-serial converter, I’m afraid the signal level would be incorrect. Normal PC serial levels work in -10V and +10V range while many embedded systems work in 0-5V or even 0-3.3V range. So you’d have to use a MAX232 or compatible converter to use your PC’s serial connection or I’d suggest to use the USB-serial converter instead. Hope this helps.

          • Philgood

            Thank you Angga for your quick reply. I’ll see if i can buy an USB-Serial converter this afternoon. Actually i was hoping Alex could hop on here because he got it working with his unit, same model as mine.

          • Philgood

            I purchased an USB-Serial converter but i’m not succeding to get any output in the terminal programm. I checked with another router connected to it and it’s working so i guess i still got not the right pinout. I tried to find the right pinout following this web ( Could you send me the email of Alex so that i can get in contact with him to send me the pinout ?

      • Alex

        I have connected the router (btw, it’s another kind, it’s IX380). Now the problem is either baud or encoding. Can you tell me what encoding were you using?

        • Ah, a different one. I think maybe one of the pins is connected to a capacitor (check both RX & TX lines). In any case, make sure you use standard serial baud rates (115200 or 57600, or 38400).

        • Adil

          CAn you help me to locate the RX TX and GND please??

  • jesus ortega colete

    hola yo tengo un router zte wimax xi 380 y me gustaria saber si se puede piratear , para tener internet gratis,me gusto mucho el videotutorial de el ix350, y quisiera que si es posible me ayudaseis a hacer lo mismo con el ix380 mio el de las dos antenas, por favor si es posible urgente , me lo van a cortar devo 2 facturas y no puedo pagarlas mi telefono es 645877593 mi email, mi idioma es el español asi que tuve que traducir vuestra pagina, tenerlo en cuenta a la hora de responder , un saludo gracias

    • Hola! Lo siento, pero no te puedo ayudar con eso. El ajuste para el propio módem es específica para su servicio de suscripción. Esta guía es sólo para obtener las credenciales administrativas para modificar los parámetros del router, como el cambio de DHCP y la configuración DMZ.

  • jesus ortega colete

    hola soy yo denuevo ,jesus orterga colete, ahora tengo un zte ix350de instanet, y quisiera que me explicases de forma mas coloquial si se podria, tener internet gratis con el , la pagina esta en ingles y aunque la traduci no entiendo nada de nada ,si sueldo, los cables a donde tienen que ir a parar al puerto usb de un ordenador,o llevan algun cable especial y paraque funcione el tema , ¿tiene que ir unido a otro router activo , (pagando un de los dos)

  • Adil

    Is there anyway to locate jtag pinout for ZTE IX380?? or its the same as the IX350??

  • mekkon

    Buenas, he adquirido recientemente este router y he hecho las conexiones para el puerto serie, he probado diversos parámetros en minicom pero no voy más allá de un montón de caracteres sin sentido. Como detalle, cuando conecto únicamente la masa de la fuente de alimentación, el minicom saca los mismos caracteres raros. ¿alguna idea de que puede ser?

  • Stefan

    Hello, I am from Romania and i have this modem. I have more problem, signal low, disconnects very often. Do you have any idea, what to do? Thanks very much Stefan

    • Maybe it is caused by interference with other wifi devices in your area. You can try to change the wifi channel from the settings, or set it to auto to let the modem select the best channel based on your circumstances..

  • Darky

    After how much time do you get the shell to enter that command?I have an WiMax ix350 opened putty start showing some unknown characters but now I have to wait to finishing the initialisation…?

    • After all initialisations have been completed, it is just a matter of pressing any key to get to the shell actually. If what you get is just garbage characters, maybe there is baud rate mismatch. Make sure the settings are correct, i.e. try between 115200 or 57600 or 9600.