TP-LINK TD-W8901N v1

From TechInfoDepot
Jump to navigationJump to search
multiple revisions of this device, use caution
bgn (N150)
150Mbps Wireless N ADSL2+ Modem Router
Wikipedia TP-Link
3rd Party Firmware
dd-wrt Incompatible
OpenWrt Incompatible
Tomato any flavor Incompatible
Platform
BrandModelRev TP-LINK TD-W8901N v1
FCC ID TE7TDW8901NV1
IC ID 8853A-W8901N
Board ID 2011500135
Type wireless router, dsl modem
CPU1 checkY Ralink RT63365E
CPU1 Type MIPS 34KEc
CPU1 Speed 500 MHz
Flash1 Chip Winbond W25Q16DVSIG
Flash1 Size 2 MiB2,097,152 B <br />16,384 Kib <br />2,048 KiB <br />16 Mib <br />0.00195 GiB <br />
RAM1 Size 8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br />
RAM1 Chip ESMT M12L64164A-5T
ETH chip1 Ralink RT63365E
Switch Ralink RT63365E
Ethernet Port Count 4-100MbE-LAN
Wired Standard IEEE 802.3i/3u

802dot11 OUI: A0:F3:C1 (7 E, 7 W), E8:94:F6 (2 E, 3 W)
Ethernet OUI: A0:F3:C1 (7 E, 7 W), E8:94:F6 (2 E, 3 W)

Expansion IF types none specified
Power 9 VDC, 0.6 A
Connector type barrel
Other

Default IP address: 192.168.1.1
the IP 192.168.1.1 is used by 1335 additional devices
of which 111 are TP-LINK devices
Default login user: admin
Default login password: admin
admin:admin credentials used by 1347 additional devices
of which 282 are TP-LINK devices

Manuf/OEM/ODM TP-LINK
Retail
FCC approval date 24 May 2013
Country of manuf China
Radio 1
Chip1 Ralink RT5390
Wireless interface OUI A0:F3:C1, E8:94:F6
Antenna Connector Type none specified
MIMO status 1x1:1
Wireless Standard IEEE 802.11b/g/n
802.11n up to 150 Mbps
802.11g up to 54 Mbps
802.11b up to 11 Mbps
WiFi Operating Frequency 2.4 GHz
 CPU1 brandRadio1 chip1 brandRadio1 chip2 brand
TP-LINK TD-W8901N v1RalinkRalink
TP-LINK TD-W8901N v2RalinkMediaTek

For a list of all currently documented Ralink chipsets with specifications, see Ralink.

For a list of all currently documented TP-LINK devices with specifications, see TP-LINK.

150 Mbps - 1SS 2.4GHz 802.11n (40MHz chan.) = N150 class

Overview

"2011500135" is silkscreened on the board in the FCC photos.

The SoC used is a Ralink RT63365E.

A MAC address w/ a A0:F3:C1 OUI is shown on the FCC EUT's label.

FCC unit has RAM chip by EtronTech.

From an actual unit (not FCC):

  • Ralink RT63365E
  • ESMT M12L64164A-5T
  • Winbond 25Q16DVSIG
  • Ralink RT5390RL
  • Ralink RT63087N (ADSL Front-End)
  • MAC Address: E8:94:F6:xx:xx:xx

Operating System: "RAS"

(OS genealogy: w:ThreadX OS by Express Logic/Green Hills ->
w:ZyNOS by ZyXEL -> used by TrendChip -> RAS OS by Ralink)

The hardware is OK, the firmware is crap:

  • The device ships with firmware V1_121121:
    • has port 7547 OPEN to the internet (admin/admin)
    • allows direct download of the router configuration file at:
http://192.168.1.1/ROM-0
  • vulnerable to Misfortune Cookie (RCE) on WAN port: RCE
  • Latest available firmware V1_140227:
    • closed port 7547 from WAN side (LAN side is still open)
    • still vulnerable to Misfortune Cookie (RCE) on LAN port, not on WAN port
    • leaks random internal memory blocks in IGMP packets trailing data
(username, password and various packet fragments have been seen)
  • IGMP cannot be disabled
    • "fixed" the ROM-0 vulnerability by requiring a valid referrer
in the http request... (easy to bypass)

Open LAN (local) ports (in latest firmware V1_140227):

  • 21/tcp (ftp)
  • 23/tcp (telnet)
  • 80/tcp (web)
  • 7547/tcp (tr069/CWMP - CPE WAN Management Protocol)
- even if disabled in web interface

Web server (port 80 and port 7547): RomPager/4.07 UPnP/1.0

(vulnerable to Misfortune Cookie)

Web interface is basic. Telnet interface has a metric assload of configuration

options and diagnostic pages, (very partially) detailed in: Ref. Manual