Hardware Specifications

Software versions

hardware version          = 4EF8.D
main software version     = V5R025C00S126
standby software version  = V5R025C00S121
uboot version             = 2022.07
kernel version            = 5.10.0

Flash layout

The boot arguments report flashsize=0x10000000, ddr_realsize=512M, flash_chip=spinand, and a SquashFS root inside ubilayer_v5.

The allsystemA and allsystemB volumes provide the A/B firmware images. The tested unit booted the SquashFS image embedded in allsystemB; writable application data is stored on UBI volumes mounted below /mnt/jffs2.

Access

Vendor CLI

Both Telnet and SSH were disabled in the tested TrueOnline configuration. After they were enabled, Telnet (TCP 23) and the vendor-modified Dropbear service (TCP 22) both opened the Huawei-style WAP CLI. SSH does not provide a normal POSIX shell and may present a second Login: prompt inside the SSH session.

The tested configuration has separate privileged accounts:

• superadmin is the X_HW_CLIUserInfoInstance used by the WAP CLI;
• telecomadmin is a level-0 X_HW_WebUserInfoInstance used by the web interface.

They are not interchangeable, and their passwords are operator/device-specific.

Useful read-only commands include:

display version
display onu info
display pppoe client all
display current-configuration
display tr069 info

The su command changes the prompt from WAP> to SU_WAP>. The subsequent vendor shell command remains restricted and must not be confused with unrestricted Linux root access.

GPON status

Getting the operational status of the ONU

SU_WAP> display onu info
onuid:<redacted> reg status:O5 xpon module:1

success!

Confirming bridge mode

When the Internet WAN is bridged, the ONT has no local PPP client:

SU_WAP> display pppoe client all
----------------------------------------------------------------------
Index  Interface HW Addr             State           IP/Netmask
----------------------------------------------------------------------
----------------------------------------------------------------------
Total: 0
success!

On the tested TrueOnline service, VLAN 100 with priority 0 was retained while the WAN was changed to PPPoE_Bridged with NAT disabled. A downstream router connected to the 2.5GbE LAN1 port then established the PPPoE session. These VLAN and authentication details are operator-specific.

Configuration format

Configuration exports use two layers of Huawei encryption:

1. The complete XML is gzip-compressed, encrypted with the AESCrypt2 AES-256-CBC/HMAC-SHA256 format, and prefixed by an eight-byte Huawei header. The header checksum uses polynomial 0x04C11DB7, flushing four zero bytes after every 1024-byte chunk of IV || ciphertext || HMAC.
2. Sensitive XML attribute values may additionally use Huawei $2...$ strings: AES-256-CBC with an appended IV and a custom printable base-93 representation.

NetworkAndRouterTools supports the outer configuration wrapper, while huawei-utility-page documents and implements the inline $2...$ format.