search

jclehner / bcm2-utils

Utilities for Broadcom-based cable modems
GNU General Public License v3.0
142 stars 23 forks source link

Cisco EPC3010 boot process locked #40

Open mediotex opened 2 years ago

mediotex commented 2 years ago

I tried to access serial interface on Cisco EPC3010 model: the bootloader is locked, and there's no access to bootloader menu. Console output just stops print at some point, and further output is hidden from display. output: In that case, the only way is to get a full dump from the flash chip?

jclehner commented 2 years ago

Disconnect the coax, reset the modem to factory defaults. Then check if you have got SNMP access to either 192.168.0.1 or 192.168.100.1. If so, you might be able to enable the serial console via SNMP!

mediotex commented 2 years ago

I always checked without a coax. Tried to reset, SNMP access is available, MIB tree is limited to 467 objects. Not sure what MIB can enable it.

jclehner commented 2 years ago

Try bfcSerialConsoleMode (1.3.6.1.4.1.4413.2.2.2.1.9.1.2.1.0) first. First set it to 2, then 0, then 2 again, and check your serial output while you're doing so.

mediotex commented 2 years ago 
Error in packet.
Reason: noAccess
Failed object: SNMPv2-SMI::enterprises.4413.2.2.2.1.9.1.2.1.0
jclehner commented 2 years ago

How about cmConsoleMode (1.3.6.1.4.1.1429.77.1.4.7.0)?

mediotex commented 2 years ago

Same error. The MIB tree contains only one enterprises group.

...
SNMPv2-SMI::enterprises.4491.2.1.20.1.1.1.1.2 = INTEGER: 3
SNMPv2-SMI::enterprises.4491.2.1.20.1.1.1.1.2 = No more variables left in this MIB View (It is past the end of the MIB tree)
jclehner commented 2 years ago

Does this modem support saving and restoring a config file?

mediotex commented 2 years ago

No, its simple data modem, not EMTA. I tried to check if I can use the 'Cable Haunt' exploit to enable shell, but this modem seems not affected. I didn't find the spectrum analyzer on 8080 port, nor on other ports, only http port 80 is open.