TP-LINK TD-W8901N v1
bgn (N150) | |||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
150Mbps Wireless N ADSL2+ Modem Router | |||||||||||||
Wikipedia | TP-Link | ||||||||||||
3rd Party Firmware | |||||||||||||
dd-wrt | Incompatible | ||||||||||||
OpenWrt | Incompatible | ||||||||||||
Tomato any flavor | Incompatible | ||||||||||||
Platform | |||||||||||||
Brand • Model • Rev | TP-LINK TD-W8901N v1 | ||||||||||||
FCC ID | TE7TDW8901NV1 | ||||||||||||
IC ID | 8853A-W8901N | ||||||||||||
Board ID | 2011500135 | ||||||||||||
Type | wireless router, dsl modem | ||||||||||||
CPU1 ![]() | Ralink RT63365E | ||||||||||||
CPU1 Type | MIPS 34KEc | ||||||||||||
CPU1 Speed | 500 MHz | ||||||||||||
Flash1 Chip | Winbond W25Q16DVSIG | ||||||||||||
Flash1 Size | 2 MiB2,097,152 B <br />16,384 Kib <br />2,048 KiB <br />16 Mib <br />0.00195 GiB <br /> | ||||||||||||
RAM1 Size | 8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br /> | ||||||||||||
RAM1 Chip | ESMT M12L64164A-5T | ||||||||||||
ETH chip1 | Ralink RT63365E | ||||||||||||
Switch | Ralink RT63365E | ||||||||||||
Ethernet Port Count | 4-100MbE-LAN | ||||||||||||
Wired Standard | IEEE 802.3i/3u | ||||||||||||
Expansion IF types | none specified | ||||||||||||
Power | 9 VDC, 0.6 A | ||||||||||||
Connector type | barrel | ||||||||||||
| |||||||||||||
| |||||||||||||
Other | |||||||||||||
Default IP address: 192.168.1.1 | |||||||||||||
Manuf/OEM/ODM | TP-LINK | ||||||||||||
Retail | |||||||||||||
FCC approval date | 24 May 2013 | ||||||||||||
Country of manuf | China | ||||||||||||
Radio 1 | |||||||||||||
Chip1 | Ralink RT5390 | ||||||||||||
Wireless interface OUI | A0:F3:C1, E8:94:F6 | ||||||||||||
Antenna Connector Type | none specified | ||||||||||||
MIMO status | 1x1:1 | ||||||||||||
Wireless Standard | IEEE 802.11b/g/n | ||||||||||||
802.11n | up to 150 Mbps | ||||||||||||
802.11g | up to 54 Mbps | ||||||||||||
802.11b | up to 11 Mbps | ||||||||||||
WiFi Operating Frequency | 2.4 GHz | ||||||||||||
|
For a list of all currently documented Ralink chipsets with specifications, see Ralink.
For a list of all currently documented TP-LINK devices with specifications, see TP-LINK.
- • 150 Mbps - 1SS 2.4GHz 802.11n (40MHz chan.) = N150 class
Overview
"2011500135" is silkscreened on the board in the FCC photos.
- The SoC used is a Ralink RT63365E.
A MAC address w/ a A0:F3:C1 OUI is shown on the FCC EUT's label.
- FCC unit has RAM chip by EtronTech.
From an actual unit (not FCC):
- Ralink RT63365E
- ESMT M12L64164A-5T
- Winbond 25Q16DVSIG
- Ralink RT5390RL
- Ralink RT63087N (ADSL Front-End)
- MAC Address: E8:94:F6:xx:xx:xx
Operating System: "RAS"
- (OS genealogy: w:ThreadX OS by Express Logic/Green Hills ->
- w:ZyNOS by ZyXEL -> used by TrendChip -> RAS OS by Ralink)
The hardware is OK, the firmware is crap:
- The device ships with firmware V1_121121:
- has port 7547 OPEN to the internet (admin/admin)
- allows direct download of the router configuration file at:
- http://192.168.1.1/ROM-0
- vulnerable to Misfortune Cookie (RCE) on WAN port: RCE
- Latest available firmware V1_140227:
- closed port 7547 from WAN side (LAN side is still open)
- still vulnerable to Misfortune Cookie (RCE) on LAN port, not on WAN port
- leaks random internal memory blocks in IGMP packets trailing data
- (username, password and various packet fragments have been seen)
- IGMP cannot be disabled
- "fixed" the ROM-0 vulnerability by requiring a valid referrer
- in the http request... (easy to bypass)
Open LAN (local) ports (in latest firmware V1_140227):
- 21/tcp (ftp)
- 23/tcp (telnet)
- 80/tcp (web)
- 7547/tcp (tr069/CWMP - CPE WAN Management Protocol)
- - even if disabled in web interface
Web server (port 80 and port 7547): RomPager/4.07 UPnP/1.0
- (vulnerable to Misfortune Cookie)
Web interface is basic. Telnet interface has a metric assload of configuration
- options and diagnostic pages, (very partially) detailed in: Ref. Manual
- TP-LINK
- Embedded system/wireless router
- Embedded system/dsl modem
- Embedded System Ralink
- Embedded System RT63365E
- Ralink
- Embedded System MIPS 34KEc
- Embedded System
- Manuf TP-LINK
- Embedded System RT5390
- Has Mimo Status
- Embedded System IEEE 802.11b/g/n
- Single-Radio Wireless Embedded System
- Wireless Embedded System
- Single-Band
- English Documentation