TP-LINK TD-W8901N v1

From TechInfoDepot
Jump to navigationJump to search
multiple revisions of this device, use caution
bgn (N150)
150Mbps Wireless N ADSL2+ Modem Router
Wikipedia
3rd Party Firmware
dd-wrt
OpenWrt
Incompatible
Tomato any flavor
Incompatible
Platform
BrandModelRev
TP-LINK TD-W8901N v1
FCC ID
IC ID
Board ID
2011500135
Type
wireless router, dsl modem
CPU1
Ralink RT63365E
CPU1 Type
MIPS 34KEc
CPU1 Speed
500 MHz
Flash1 Chip
Winbond W25Q16DVSIG
Flash1 Size
2 MiB2,097,152 B <br />16,384 Kib <br />2,048 KiB <br />16 Mib <br />0.00195 GiB <br />
RAM1 Size
8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br />
RAM1 Chip
ESMT M12L64164A-5T
ETH chip1
Ralink RT63365E
Switch
Ralink RT63365E
Ethernet Port Count
4-100MbE-LAN
Wired Standard
IEEE 802.3i/3u

802dot11 OUI: A0:F3:C1 (7 E, 7 W), E8:94:F6 (2 E, 3 W)
Ethernet OUI: A0:F3:C1 (7 E, 7 W), E8:94:F6 (2 E, 3 W)

Expansion IF types
none specified
Power
9 VDC, 0.6 A
Connector type
barrel
Other

Default IP address: 192.168.1.1
the IP 192.168.1.1 is used by 1308 additional devices
of which 110 are TP-LINK devices
Default login user: admin
Default login password: admin
admin:admin credentials used by 1331 additional devices
of which 279 are TP-LINK devices

Manuf/OEM/ODM
Retail
FCC approval date 24 May 2013
Country of manuf China
Radio 1
Chip1
Ralink RT5390
Wireless interface OUI
A0:F3:C1, E8:94:F6
Antenna Connector Type
none specified
MIMO status
1x1:1
Wireless Standard
IEEE 802.11b/g/n
802.11n
up to 150 Mbps
802.11g
up to 54 Mbps
802.11b
up to 11 Mbps
WiFi Operating Frequency
2.4 GHz
 CPU1 brandRadio1 chip1 brandRadio1 chip2 brand
TP-LINK TD-W8901N v1RalinkRalink
TP-LINK TD-W8901N v2RalinkMediaTek

For a list of all currently documented Ralink chipsets with specifications, see Ralink.

For a list of all currently documented TP-LINK device with specifications, see TP-LINK.

150 Mbps - 1SS 2.4GHz 802.11n (40MHz chan.) = N150 class

Overview

"2011500135" is silkscreened on the board in the FCC photos.

The SoC used is a Ralink RT63365E.

A MAC address w/ a A0:F3:C1 OUI is shown on the FCC EUT's label.

FCC unit has RAM chip by EtronTech.

From an actual unit (not FCC):

  • Ralink RT63365E
  • ESMT M12L64164A-5T
  • Winbond 25Q16DVSIG
  • Ralink RT5390RL
  • Ralink RT63087N (ADSL Front-End)
  • MAC Address: E8:94:F6:xx:xx:xx

Operating System: "RAS"

(OS genealogy: w:ThreadX OS by Express Logic/Green Hills ->
w:ZyNOS by ZyXEL -> used by TrendChip -> RAS OS by Ralink)

The hardware is OK, the firmware is crap:

  • The device ships with firmware V1_121121:
    • has port 7547 OPEN to the internet (admin/admin)
    • allows direct download of the router configuration file at:
http://192.168.1.1/ROM-0
  • vulnerable to Misfortune Cookie (RCE) on WAN port: RCE
  • Latest available firmware V1_140227:
    • closed port 7547 from WAN side (LAN side is still open)
    • still vulnerable to Misfortune Cookie (RCE) on LAN port, not on WAN port
    • leaks random internal memory blocks in IGMP packets trailing data
(username, password and various packet fragments have been seen)
  • IGMP cannot be disabled
    • "fixed" the ROM-0 vulnerability by requiring a valid referrer
in the http request... (easy to bypass)

Open LAN (local) ports (in latest firmware V1_140227):

  • 21/tcp (ftp)
  • 23/tcp (telnet)
  • 80/tcp (web)
  • 7547/tcp (tr069/CWMP - CPE WAN Management Protocol)
- even if disabled in web interface

Web server (port 80 and port 7547): RomPager/4.07 UPnP/1.0

(vulnerable to Misfortune Cookie)

Web interface is basic. Telnet interface has a metric assload of configuration

options and diagnostic pages, (very partially) detailed in: Ref. Manual