Ruckus Wireless ZoneFlex 7351

abgn (AN600)
ZoneFlex 7351 (ZF7351) 802.11n Multimedia Wi-Fi Access Point
Support	Support page
WikiDevi.wi-cat.ru	Ruckus Wireless ZoneFlex 7351
3rd Party Firmware
dd-wrt	Status Unknown
OpenWrt	Supported
Tomato any flavor	Incompatible
Gargoyle	Status Unknown
Platform
Brand • Model • Rev	Ruckus Wireless ZoneFlex 7351-U
FCC ID	S9GZF7351
IC ID	5912A-ZF7351
Type	access point
CPU1 Y	Atheros AR7161
CPU1 Type	MIPS 24K
CPU1 Speed	680 MHz 32-bit
Flash1 Chip	Brand? Model?
Flash1 Size	8 MiB 8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br /> (SPI NOR)
RAM1 Size	64 MiB 67,108,864 B <br />524,288 Kib <br />65,536 KiB <br />512 Mib <br />0.0625 GiB <br /> (DDR)
RAM1 Chip	Micron MT46V16M16-5B K x 2
ETH chip1	Atheros AR7161
ETH chip2	Marvell 88E1116R
Ethernet Port Count	1-1GbE-LAN
Wired Standard	IEEE 802.3i/3u/3ab
802dot11 OUI: none specified
Stock bootloader	U-Boot
Expansion IF types	none specified
Power	12 VDC, 1 A
Connector type	barrel
Serial Port (UART)	yes, 3.3V TTL, (115200 8N1)
Other
Default login user: super Default login password: sp-admin super:sp-admin credentials used by 16 additional devices of which 16 are Ruckus Wireless devices
3rd Party Firmware Support	OpenWrt • (List | Dev | DLs)
Retail
FCC approval date	13 February 2013
Radio 1
Chip1	Atheros AR9223
Wireless interface OUI	none specified
Antenna Connector Type	U.FL
MIMO status	2x2:2
Wireless Standard	IEEE 802.11b/g/n
802.11n	up to 300 Mbps
802.11g	up to 54 Mbps
802.11b	up to 11 Mbps
WiFi Operating Frequency	2.4 GHz
Radio 2
Chip1	Atheros AR9220
Wireless interface OUI	none specified
Antenna Connector Type	U.FL
MIMO status	2x2:2
Wireless Standard	IEEE 802.11a/n
802.11n	up to 300 Mbps
802.11a	up to 54 Mbps
WiFi Operating Frequency	5 GHz

For a list of all currently documented Atheros (QCA) chipsets with specifications, see Atheros.
For a list of all currently documented Marvell chipsets with specifications, see Marvell.

For a list of all currently documented Ruckus Wireless devices with specifications, see Ruckus Wireless.

• 300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.),

• 300 Mbps - 2SS 5GHz 802.11n (40MHz chan.) = AN600 class

Overview

The Ruckus Wireless logo (dog version), "2012 Ruckus Wireless Inc.", "GD 38"

and "Pocket Dog" is silkscreened on the board in the FCC photos.

"FAB 100-11224-001 REV A" is on the other side of the board.

"Ruckus Wireless" and "100-11238-001 REV A" is silkscreened on two of the antennas.

The manual specifies the model as ZoneFlex 7351-U (presumably a sub-model w/ a USB port).

• Atheros AR7161 + AR9220 + AR9223/7 device

Flashing

Flashing OpenWrt

On the OpenWrt ToH (techdata entry)

Target: ath79
Subtarget: generic
Package architecture: mips_24kc
Supported Since Commit
Support started version: 23.05.0
Current supported version: 25.12.1

WLAN Hardware: Atheros AR9223, Atheros AR9220
WLAN Comment: 2x2 MIMO both channels
Installation method(s):
see git-commit
Recovery method(s):
see git-commit

git • >>

ath79: support Ruckus ZoneFlex 7351 Ruckus ZoneFlex 7351 is a dual-band, dual-radio 802.11n 2x2 MIMO enterprise access point. Hardware highligts: - CPU: Atheros AR7161 SoC at 680 MHz - RAM: 64MB DDR - Flash: 16MB SPI-NOR - Wi-Fi 2.4GHz: AR9280 PCI 2x2 MIMO radio with external beamforming - Wi-Fi 5GHz: AR9280 PCI 2x2 MIMO radio with external beamforming - Ethernet: single Gigabit Ethernet port through Marvell 88E1116R gigabit PHY - Standalone 12V/1A power input - USB: optional single USB 2.0 host port on the 7351-U variant. Serial console: 115200-8-N-1 on internal H1 header. Pinout: H1 ---------- |1|x3|4|5| ---------- Pin 1 is near the "H1" marking. 1 - RX x - no pin 3 - VCC (3.3V) 4 - GND 5 - TX Installation: - Using serial console - requires some disassembly, 3.3V USB-Serial adapter, TFTP server, and removing a single T10 screw. 0. Connect serial console to H1 header. Ensure the serial converter does not back-power the board, otherwise it will fail to boot. 1. Power-on the board. Then quickly connect serial converter to PC and hit Ctrl+C in the terminal to break boot sequence. If you're lucky, you'll enter U-boot shell. Then skip to point 3. Connection parameters are 115200-8-N-1. 2. Allow the board to boot. Press the reset button, so the board reboots into U-boot again and go back to point 1. 3. Set the "bootcmd" variable to disable the dual-boot feature of the system and ensure that uImage is loaded. This is critical step, and needs to be done only on initial installation. > setenv bootcmd "bootm 0xbf040000" > saveenv 4. Boot the OpenWrt initramfs using TFTP. Replace IP addresses as needed: > setenv serverip 192.168.1.2 > setenv ipaddr 192.168.1.1 > tftpboot 0x81000000 openwrt-ath79-generic-ruckus_zf7351-initramfs-kernel.bin > bootm 0x81000000 5. Optional, but highly recommended: back up contents of "firmware" partition: $ ssh root@192.168.1.1 cat /dev/mtd1 > ruckus_zf7351_fw_backup.bin 6. Copy over sysupgrade image, and perform actual installation. OpenWrt shall boot from flash afterwards: $ ssh root@192.168.1.1 # sysupgrade -n openwrt-ath79-generic-ruckus_zf7351-squashfs-sysupgrade.bin After unit boots, it should be available at the usual 192.168.1.1/24. Return to factory firmware: 1. Copy over the backup to /tmp, for example using scp 2. Unset the "bootcmd" variable: fw_setenv bootcmd "" 3. Use sysupgrade with force to restore the backup: sysupgrade -F ruckus_zf7351_backup.bin 4. System will reboot. Quirks and known issues: - Flash layout is changed from the factory, to use both firmware image partitions for storage using mtd-concat, and uImage format is used to actually boot the system, which rules out the dual-boot capability. - Both radio has its own EEPROM on board, not connected to CPU. - The stock firmware has dual-boot capability, which is not supported in OpenWrt by choice. It is controlled by data in the top 64kB of RAM which is unmapped, to avoid the interference in the boot process and accidental switch to the inactive image, although boot script presence in form of "bootcmd" variable should prevent this entirely. - On some versions of stock firmware, it is possible to obtain root shell, however not much is available in terms of debugging facitilies. 1. Login to the rkscli 2. Execute hidden command "Ruckus" 3. Copy and paste ";/bin/sh;" including quotes. This is required only once, the payload will be stored in writable filesystem. 4. Execute hidden command "!v54!". Press Enter leaving empty reply for "What's your chow?" prompt. 5. Busybox shell shall open. Source: https://alephsecurity.com/vulns/aleph-2019014 - There is second method to achieve root shell, using command injection in the web interface: 1. Login to web administration interface 2. Go to Administration > Diagnostics 3. Enter |telnetd${IFS}-p${IFS}204${IFS}-l${IFS}/bin/sh into "ping" field 4. Press "Run test" 5. Telnet to the device IP at port 204 6. Busybox shell shall open. Source: https://github.com/chk-jxcn/ruckusremoteshell

Pictures

Retail Images

• 
  Atheros AR7161
• 
  Atheros AR7161 Spec.
• 
  Atheros AR9220