2

I have a Zyxel C3000A ADSL/VDSL modem (CenturyLink branding). I have searched, and it seems it is not possible to purchase this device without CenturyLink branding and firmware.

The device has the most recent firmware installed as I write this (CZD005-4.16.011.0).

I can ssh to the device without issues:

login as: admin
admin@192.168.0.1's password: <entered my password>
>

However, when I try to run the sh command to access the shell, I get prompted for a password again. I tried a username of admin and my ssh password, but all I get is:

> sh
Please input shell credential to login
Login:admin
Password: <entered my password again>
Password Incorrect! Try again.

I also tried a username of admin and the default password of the device (on the device's sticker), but that password doesn't work either.

In other words: There is an ADDITIONAL password to access the sh prompt on the C3000Z. I don't see this additional password anywhere on the device or in the configuration GUI.

I have performed a reset of the device but the additional sh password is still there.

Does anyone know what credentials to use for sh console access on the CenturyLink C3000Z device?

Bill_Stewart
  • 1,502
  • 1
  • 9
  • 14

2 Answers2

1

I've been in contact with someone who has a C1000A with firmware version CA004-31.30L.95 and has the same problem. We don't know what user/password it wants, but the extra lock can be bypassed using shell injection at the > prompt. Try typing echo ;sh or similar instead of sh after logging in:

$ telnet 192.168.0.1
Trying 192.168.0.1...
Connected to 192.168.0.1.
Escape character is '^]'.
===Actiontec xDSL Router===
Login: admin
Password: <password set in "Remote Console" GUI page>
 > echo ;sh

BusyBox v1.17.2 (2018-03-02 10:34:35 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
Jakob
  • 111
0

At least on the C1000A, this didn't use to be the case. It used to give shell access after sh. A firmware update sometime in the last few years might be why.

In other words, this appears to have been disabled and probably isn't accessible anymore.

Benjamin Oakes
  • 5,073