How do you get the Super Password for the China Mobile optical modem? Getting it was just the first step; it was only tricked by RMS in the middle of the night when it was quietly reverted

Last year,

Fan Xiaojia got a 500Mbps broadband service for China Mobile. After the installer left, he started thinking about two things: turn off the WiFi on the optical modem (which conflicts with his own Mesh router's signal), and switch to bridging to let the router dial up. But on the login page, he entered CMCCAdmin, and for the password field, he tried the default string copied from the internet. After three consecutive errors, he locked the account for five minutes. He called to ask about me. I accompanied him from the optical modem sticker all the way to Telnet, struggling all night before I realized: the China Mobile lock is not the same as China Telecom's.

first identify the three accounts on the China Mobile Light Modem

flipped through the optical modem to look at the stickers. The account passwords printed were for regular users: usernames were called user, and passwords were printed on the labels in a string on each device. This account can only do very limited things inside: checking connection status, changing WiFi name and password, restarting devices—roughly that's about it. If you want to use WAN connection, change bridging, or delete remote management, none of these are possible.

the real key is the super moderator account, CMCCAdmin the account is not on the sticker. The most widely circulated default password online is aDm8H%MdA (case-sensitive, % should not be written as full-width), and another backup is Cmcc10086#. To avoid logging into the super admin, usually enter the browser by typing 192.168.1.1 and then selecting the account section. For some Huawei models, the address is 192.168.100.1.

there's a third 'account' you can't see: Mobile's remote management platform, called RMS in jargon. It corresponds to the ITMS set used by China Telecom, serving the same purpose—the office remotely manages your optical modem and regularly issues configurations. Remember this name, you'll have to take it later.

What can

account	password	do
user (on stickers)	a string printed on the phone with a label	check status, change WiFi name and password, restart
CMCCAdmin (super admin)	Default aDm8H%MdA, most have been changed	bridge, turn off WiFi, use WAN, delete remote management
RMS (cloud),	are no longer under your control	regularly push the changes back to default

First Way: Try the default password directly—if you get it, it's luck

Don't rush to think this path is useless. My childhood friend's phone locked the account three times wrong because he typed a character wrong in the password (% was typed into a full character). Calm down and copy and paste aDm8H%MdA, the second one went in—his phone was a 2023 Huawei mobile custom phone, old firmware, and the bureau didn't have time to launch the new password.

which machines are easy to use on the first try? Some never upgraded the firmware after assembly, some technicians just wanted to save trouble without changing the password, and some provinces were simply too lazy to change it. The difference between China Mobile and China Unicom is that the default password one province and one change: the aDm8H%MdA string online is the most widely circulated version, while some provinces have long since switched to other strings. So try to set the default password to no more than two or three groups. The locking mechanism is real—lock for five to ten minutes after a few mistakes, just like the telecom rules.

if it doesn't work, stop it. Don't go head-to-head with the login box. Go down the second path.

second option: Telnet to go in, Huawei and ZTE each have their own methods

the computer's Home menu, search for "Enable or disable Windows features," check the telnet client, and then type telnet 192.168.1.1 in the command line. Account CMCCAdmin, but the password should still be tested by default first—the telnet channel password and the superadmin password for web login are often different . It's common for the webpage to be changed by the technician, but the telnet side still retains the default string. This is a benefit of old firmware.

entered, it was a command line, so there were many things to do: copy the configuration files and flip through them slowly, with the super admin password and broadband account lying inside. Huawei machines need to pass the 'activation' stage. I previously wrote about the specific tools and steps in the article about opening Telnet on Huawei's optical modem, so I won't repeat it here. want to take this path old texts. ZTE and Fenghuo have different machine paths; each vendor's name is the same in the place you translate. I'm being vague about this step on purpose—if the model is just a bit short of the command, you'll miss the command. Copying universal online tutorials will probably get stuck halfway. Identifying your own model and searching for the corresponding posts saves you time.

childhood friend's device didn't reach the telnet deep water zone in the end because we got the password on the third road. But I remember this path here, leaving it for those who can't take the first two.

third option: find a maintenance technician or call 10086, with a

this is the route I most recommend for ordinary people. My childhood friend's approach at the time: found the installer's phone number in the mobile app (the installation work order was on it) and directly said, "I bought my own router, the optical modem needs to be bridged, please give me a super password." The technician's first reaction is usually to make excuses, saying "I can't change" or "There's no need." At this point, don't force it; put it another way—

"Master, I can fix it myself. I'll use the password for a bit. If I break it, I won't contact you."

the weight of this sentence lies in removing all responsibility. What the master fears most is giving you a password, making a mistake, or having a work order come back to him. After hearing this, my childhood friend sent me the current super admin password via SMS and casually reminded me: "After changing it, don't delete the one with TR069 in the WAN connection. If you delete it, you won't see your cat's status in the backend, and orders will be assigned." The master is willing to give it, cleaner than any cracking tool.

calling 10086 is fine, but most customer service replies that the standard answer is "super passwords not provided to outsiders." What they can ask for is the technician's contact information. When it comes to complaining, saying you want to connect to your own router for port forwarding (like remote home monitoring, etc.), the success rate is much higher than "I want a super password." This approach is similar to how telecom companies call 10,000 numbers. Telecom previously wrote an article about their tactics, the scripts can be copied from each other.

the most frustrating level: after editing, the RMS quietly reverts it in the middle of the night

got the password, my childhood friend turned off the optical modem WiFi and changed the bridge that night, and everything was fine before going to bed. The next morning, his wife said the TV was stuck and checked, the fiber modem's WiFi was back on, and the bridge was pushed back to router mode—overnight, it was back to square one. His first reaction was that someone had broken into his home, and his second reaction was to call me.

this is what the invisible 'account' mentioned at the beginning does: RMS periodically reports device status and issues central office configurations. If your local settings don't match the central office save file, they might be overwritten at some early morning. The telecom system is called ITMS, and the temper of pushing configurations late at night is something I wrote about once in a Telecom article The mobile side is exactly the same when it flares up.

the root, log in with an administrator and go to the "Network → Remote Management → RMS Server" (menu names vary slightly depending on the model; make sure to use "Remote Management" or "RMS"), and uncheck the for "Enable Periodic Reporting" in the . The checkbox on my childhood friend's device is gray and can't be clicked—this is a common little move in mobile custom firmware. The solution is to press F12 in your browser to open Developer Tools, find the checkbox in the elements panel, delete the disabled property, and return to the page to uncheck it. After making changes, save and restart the game, and from then on, RMS will no longer reach your home's configuration files.