Hardware Specifications

Vendor/Brand	TP-Link
Model	XZ005-G6 (UN) V1.0
Chipset	Realtek RTL9601D
Flash	4 MB (XMC XM25QH32CHIG, 32 Mbit SPI NOR)
RAM	32 MB (embedded)
System	Linux (MIPS), U-Boot 2011.12.NA
2.5GBaseT	Yes, 1x 2.5 Gbit/s (PHY Realtek RTL8221B)
Optics	SC/APC (laser driver UX3320S)
Power	DC 9 V / 600 mA
IP address	192.168.1.1
Web Gui	✅ no default password (set on first access, see Web Access)
SSH
Telnet	✅ limited TP-Link CLI (see Telnet)
Serial	✅
Form Factor	ONT

Note

This is a GPON-only SFU ONT. XGS-PON is not supported.

GPON Identifiers

ONU Type	SFU (Ethernet UNI: 1)
Vendor ID	TPLG
Equipment ID	XZ005-G6
Version	1.0
OMCC Version	128 (0x80)

The default GPON authentication parameters logged by the firmware are LOID tplink, password tplink.

List of software versions

• V0.1-3.0.0 (softwareVersion 0.1.0 3.0.0 v6066.0 Build 231212 Rel.36338n)

List of partitions

The firmware only exposes the configuration partition; the full MTD layout is not documented yet.

dev	mount	content
mtdblock3	/var/config	configuration data

The runtime configuration files are /var/config/lastgood.xml and /var/config/lastgood_hs.xml; factory defaults are /etc/config_default.xml and /etc/config_default_hs.xml.

Web Access

The device ships without default credentials: the password is chosen by the user on first access.

1. Factory reset by holding the rear reset button for a few seconds.
2. Open http://192.168.1.1/superadmin and set (and confirm) the superadmin password.
3. Open http://192.168.1.1 to set the normal user password (log out from superadmin first if needed).

Role	URL
User	http://192.168.1.1
Superadmin	http://192.168.1.1/superadmin

The superadmin account unlocks a few extra web settings and a higher-privilege CLI over Telnet.

Telnet

Telnet exposes TP-Link's own (limited) CLI. Once logged in, the following prompts are available:

TP-Link>          # user EXEC
TP-Link#          # privileged EXEC
TP-Link(conf)#    # configuration mode

Note

Even the superadmin-level Telnet CLI is fairly restricted compared to a full shell.

Configuration backup (conf.bin) decryption

Several GPON/OMCI parameters have no web field but can be changed by exporting the configuration backup, editing it and importing it back.

The backup (conf.bin) is a compressed XML blob encrypted with DES in ECB mode (zero-padded to an 8-byte boundary), prefixed by a 16-byte MD5 digest of the compressed payload. Support for this exact model was merged into sta-c0000/tpconf_bin_xml (PR #45), so the tool handles compression, hashing and encryption automatically:

# decrypt / unpack conf.bin to XML
python3 tpconf_bin_xml.py conf.bin conf.xml

# edit conf.xml, then pack it back
python3 tpconf_bin_xml.py conf.xml conf.bin

The DES key used for the XZ005-G6 (UN) V1.0 is the 8-byte constant:

45 EE 92 32 CF 5B 1D FE

Note

The product ID for this variant is 0x1c796e01 (readable at big-endian offset 0x34 of a same-format firmware update file). Early analysis suggested the key was derived by XOR-ing a base key with this product ID, but the merged tool uses the literal key above directly.

Known limitations

The ONU-G (hardware) version and the Software image version reported over OMCI are forced by the firmware and ignored on config import, so this device is not suitable when those fields need to be edited.

TP-Link (O3 Labs) states that no custom firmware will be produced for this device: web and OMCI updates require signed images, and while loading an image over serial/UART is possible in principle, it is considerably more involved.

References

• TP-Link XZ005-G6 (UN) V1.0 — tripleoxygen wiki
• tpconf_bin_xml — configuration backup tool (PR #45)