Unicom ZTE Optical Cat route does not obtain a super password through the operator and changes to a bridge

⚠️

Pre-warning

• Risk Warning : This operation may result in bricking of the optical cat, remote locking by the operator, or loss of warranty
• applicability : Mainly for ZTE Optical Cat (such as F650, F673AV9, F677V9, F1855V2 and other models)
• Legal Compliance : Only applies to devices legally owned by individuals, unauthorized operation may violate the service agreement

Step 1: Preparation

Step 2: Get the LOID registration code and reset the

1. record LOID code
   • use the user normal account login management interface (usually 192.168.1.1) on the back label of the optical cat
   • find LOID registration code (logical identifier for carrier authentication) and record it
2. factory reset
   • unplug the fiber and keep it powered on
   • use a toothpick to press Reset small hole on the back of the cat for 10 seconds. Release the
     when the indicator light flashes
   • wait 1 minute and then restart the light cat

Default credential after reset (varies by carrier/region):

• Unicom : CUAdmin / CUAdmin or 123456
• Telecom : telecomadmin / nE7jA% 5m
• Mobile : CMCCAdmin / aDm8H% MdA

Step 3: Turn on the Telnet service

1. download tool
   get factorymode_crack.exe (the version needs to match the production date of Guangcat, those produced after April 2022 may need v1.7 version)
2. execute the command
   open CMD in the directory where the tool is located, and enter:
   factorymode_crack.exe -l xxx open -i 192.168.1.1 -p 80 -u CUAdmin -pw CUAdmin

   parameter description :
   • -i: Optical Cat IP address
   • -p: Port (80 or 8080, depending on model)
   • -u/-pw: Current web management username and password
3. Example
   successfully return
   get Telnet credentials:

   Enter 192.168.1.1 FactoryMode Success:FactoryModeAuth.gch?user=Vk0P691b&pass=R7phPq8D

   • username :Vk0P691b
   • password : R7phPq8D
     (the credentials generated are different for each execution and expire after power outage)

Step 4: Lightcat Registration (Key Steps)

1. browser access http://192.168.1.1/cu.html (Unicom) or the corresponding carrier registration page
2. enter the LOID registration code you recorded earlier complete the authentication
3. wait for the light cat registration to be successful (the indicator light is normal)

Step 5: Extract the configuration file via Telnet

1. Turn on the TFTP server
   run the TFTP tool (e.g., Tftpd64) on the computer to ensure that the firewall is released and record the computer IP (e.g., 192.168.1.3).
2. Telnet Login Lightcat

   telnet 192.168.1.1

   enter the user/pass login obtained in the previous step
3. transfer profile
   executed line by line in Telnet:

   cp /userconfig/cfg/db_user_cfg.xml /mnt/ cd /mnt/ chmod 777 db_user_cfg.xml tftp -p -l db_user_cfg.xml -r db_user_cfg.xml 192.168.1.3

   Note: Replace 192.168.1.3 with the actual computer IP

Step 6: Decrypt the profile to get the password

1. prepare the decryption tool
   download zxcfg.exe (or ztecfg.exe) v1. 2 versions
2. perform decryption
   put db_user_cfg.xml into the tool directory, run in CMD:

   .\zxcfg.exe -d AESCBC -i .\db_user_cfg.xml -o break.cfg
3. extract key information
   open break.cfg with Notepad and search:
   • CUAdmin → below tab is the super admin password
   • UserName (broadband account) → below is the broadband dialing password

Step 7: Modify the bridge mode

1. Super Admin Login
   Log in with the obtained CUAdmin+ password 192.168.1.1/cu. html
2. modify the way you access the Internet
   • find WAN connection or internet settings
   • Change the routing mode (Router) to Bridge mode (Bridge) mode (Bridge)
   • save and restart Lightcat
3. router dialing
   • set up PPPoE dialing in your own router
   • enter the decrypted broadband account password
   • complete the Internet configuration