Gemtek WVRTM-127ACN

From TechInfoDepot
Jump to navigationJump to search
abgn+ac (AC1200)
Indoor WiFi Router
WikiDevi.wi-cat.ru Gemtek WVRTM-127ACN
3rd Party Firmware
dd-wrt Status Unknown
OpenWrt Supported
Tomato any flavor Incompatible
Gargoyle Status Unknown
Platform
Brand • Model • Rev Gemtek WVRTM-127ACN V0.2
FCC ID MXF-WVRTM127ACN
IC ID 3069B-WVRTM127ACN
Board ID 19K-513-8500R
Type wireless router, CPE
CPU1 checkY MediaTek MT7621AT
CPU1 Type MIPS 1004Kc
CPU1 Speed 880 MHz ( 2 cores ) 16-bit
Flash1 Chip ESMT F59L1G81LA-25T
Flash1 Size 128 MiB 134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br />
RAM1 Size 128 MiB 134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br />
RAM1 Chip ESMT M14D1G1664A-2.5B
ETH chip1 MediaTek MT7621AT
Switch MediaTek MT7621AT
Ethernet Port Count 1-1GbE-WAN
2-1GbE-LAN
Wired Standard IEEE 802.3i/3u/3ab

802dot11 OUI: none specified

Stock bootloader U-Boot
Expansion IF types USB 2.0
USB ports 1
USB Hub Compatible Untested
PoE 802.3at, 802.3af, standard
Power 56 VDC, 0.54 A
Connector type barrel
Serial Port (UART) yes, 3.3V TTL, (115200 8N1)

Flags:
VoIP, PoE

Other

Default SSID: Telrad2.4G_XXXXXX
, Telrad5G_XXXXXX
Default IP address: 192.168.0.1
the IP 192.168.0.1 is used by 825 additional devices
of which 1 are Gemtek devices
Default login user: admin
Default login password: admin
admin:admin credentials used by 1358 additional devices
of which 3 are Gemtek devices

3rd Party Firmware Support OpenWrt • (List | Dev | DLs)
Retail
FCC approval date 20 November 2017
Country of manuf China
Radio 1
Chip1 MediaTek MT7603EN
Wireless interface OUI none specified
Antenna Connector Type U.FL
MIMO status 2x2:2
Wireless Standard IEEE 802.11b/g/n
802.11n up to 300 Mbps
802.11g up to 54 Mbps
802.11b up to 11 Mbps
WiFi Operating Frequency 2.4 GHz
Radio 2
Chip1 MediaTek MT7612EN
Wireless interface OUI none specified
Antenna Connector Type U.FL
MIMO status 2x2:2
Wireless Standard IEEE 802.11a/n/ac
802.11ac up to 867 Mbps
802.11n up to 300 Mbps
802.11a up to 54 Mbps
WiFi Operating Frequency 5 GHz

For a list of all currently documented MediaTek chipsets with specifications, see MediaTek.

For a list of all currently documented Gemtek devices with specifications, see Gemtek.

• 300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.),
• 867 Mbps - 2SS 5GHz 802.11ac (80MHz chan.) = AC1200 class

Overview

"WVRTM-127ACN_V02", "19K-513-8500R", "RoHS" and "1717"

are silkscreened on the board in the FCC photos.

Links of Interest

  • WVRTM-127ACN Reverse Engineering Project for the router distributed in Italy by Linkem, includes router's pictures, UART position, default WiFi password recovery, how to get root access and firmware modification kit

Flashing

Flashing OpenWrt

Target: ramips
Subtarget: mt7621
Package architecture: mipsel_24kc
Supported Since Commit
Support started version: 24.10.0
Current supported version: 25.12.3
LAN Hardware: MediaTek MT7621AT
WLAN Hardware: MediaTek MT7603EN, MediaTek MT7612EN
Installation method(s):
Serial
Recovery method(s):
Serial
git • >> 
ramips: mt7621: add support for Gemtek WVRTM-127ACN and WVRTM-130ACN
The Gemtek WVRTM-127ACN is an indoor dual band wifi router
with internal antennas and 3 Gigabit Ethernet ports.

The Gemtek WVRTM-130ACN is an indoor dual band wifi router
with external antennas and 5 Gigabit Ethernet ports.

Hardware of WVRTM-127ACN:
- SoC: Mediatek MT7621AT (880 MHz, dual core)
- RAM: 128 MB
- Storage: 128 MB NAND SLC flash
- Ethernet: 3x 10/100/1000 Mbps LAN1,LAN2 & WAN
- Wireless: 2.4GHz: Mediatek MT7603EN (802.11b/g/n)
- Wireless: 5GHz: Mediatek MT7612EN (802.11n/ac)
- LEDs: 11x
- Buttons: 2x WPS, reset
- USB: 1x 3.0
- Power: 56 VDC, 0.54 A, PoE+ IN (WAN)
- PoE: 1x PoE+ 802.3af/at (WAN)
- Uart: GND RX TX VCC - J2 (GND near WAN)
- Board silkscreen: "WVRTM-127ACN_V02" "19K-513-8500R" "RoHS" "1717"

Hardware of WVRTM-130ACN:
- SoC: Mediatek MT7621AT (880 MHz, dual core)
- RAM: 128 MB (Kioxia TC58BVG0S3HTA00)
- Storage: 128 MB NAND SLC (Winbond W971GG6SB-25)
- Ethernet: 5x 10/100/1000 Mbps LAN1,LAN2,LAN3,LAN4 & WAN
- Wireless: 2.4GHz and 5GHz Mediatek MT7615DN (802.11ac/b/g/n) (DBDC)
- LEDs: 10x
- Buttons: 3x Power, WPS, reset
- USB: 1x 3.0
- Power: 56 VDC, 0.54 A, PoE+ (WAN)
- PoE: 1x PoE+ 802.3af/at (WAN)
- Uart: GND RX TX VCC - J2 (GND near WAN)
- Board silkscreen: "WVRTM-130ACN_V01" "19K-515-4500R" "RoHS" "2112"

Enable access to uboot menu (needed in wvrtm-130acn):
- The access to uboot menu is blocked by `bootdelay = 0` set in ubootenv.
With stock firmware version 01.01.02.163 and previous, you can use CVE 2020-24365
command injection https://nvd.nist.gov/vuln/detail/CVE-2020-24365
    python3 exploit.py -t 192.168.1.1 -c "fw_setenv bootdelay 3; fw_saveenv"

Backup the stock firmware:
- Connect via uart
- Connect via ethernet and assign your pc the address 192.168.15.x/24
- Power on the device; and start typing '4' to enter uboot menu
- Set factory mode and boot
    MT7621 # setenv factory 2; saveenv
    MT7621 # nand read 2800000 2000000 81000000; bootm
- Telnet and copy all mtd blocks
    telnet 192.168.15.1
- Copy all mtd blocks and start webserver
    for N in $(seq 0 6); do dd if=/dev/mtd$N of=/tmp/eeprom_mtd$N.bin; done
    mount -o bind /tmp /www
    lighttpd -f /etc/lighttpd.conf
- Backup stock rootfs_data (optional)
    dd if=/dev/mtd7 of=/tmp/eeprom_mtd7.bin
    dd if=/dev/mtd8 of=/tmp/eeprom_mtd8.bin
- Download to your pc from http://192.168.15.1/eeprom_mtd$N.bin

Installation:
- Connect via uart
- Connect via ethernet and assign your pc the address 10.10.10.3/24
- Start a tftp server and serve the image initramfs-kernel.bin
    mkdir /tmp/ftpd;
    cp initramfs-kernel.bin /tmp/ftpd/kernel.bin
    dnsmasq --enable-tftp --tftp-root=/tmp/ftpd
- Power on the device; and start typing '4' to halt the bootloader
- Change the active mtd partition from mtd6 to mtd5 (needed by uboot)
    MT7621 # setenv mtddevnum 5; saveenv
- Write the openwrt initramfs in ram via tftp and boot it
    MT7621 # tftpboot 81000000 kernel.bin; bootm
- From the initramfs create the ubi device and install openwrt via sysupgrade
    ubiformat /dev/mtd11 -y
    sysupgrade -n -v /tmp/sysupgrade.bin

Recovery:
Restore the stock firmware from the backup of the mtd blocks
    mtd write eeprom_mtd5.bin firmware
    mtd write eeprom_mtd6.bin Kernel2
    mtd write eeprom_mtd7.bin Storage1
    mtd write eeprom_mtd8.bin Storage2
    ubiformat /dev/mtd8 -y
    reboot

Links to previous works on wvrtm-127acn:
https://github.com/digiampietro/hacking-gemtek
https://forum.openwrt.org/t/add-support-for-gemtek-wvrtm-127acn-linkem-provider/168757
Retrieved from "https://techinfodepot.shoutwiki.com/w/index.php?title=Gemtek_WVRTM-127ACN&oldid=538883"