Sponsored Links

Three 4g+ Hub ( Sercomm LTE2122GR ) Easy Hack for unlocking and enabling APN and other hidden settings.

Apologies if I am late to the party on this but I just noticed that I have access to all settings by logging into the router via my phone and toggling on 'expert mode' (see bottom right of screenshot).

No need for the Charles program to be running - just toggle on expert mode.

As I say, this may be widely known but I only just noticed so dropping it here just in case!

P.S. as an aside, I am getting decent speeds, but I never seem to get more than three bars of signal (more often only 1/2 bars) despite my router being outside in a waterproof box in line of sight of the router. Any thoughts / advice always welcomed!
 

Attachments

  • Screenshot_2024-02-03-13-21-32-16_40deb401b9ffe8e1df2f1cc5ba480b12.webp
    Screenshot_2024-02-03-13-21-32-16_40deb401b9ffe8e1df2f1cc5ba480b12.webp
    35.4 KB · Views: 133
Apologies if I am late to the party on this but I just noticed that I have access to all settings by logging into the router via my phone and toggling on 'expert mode' (see bottom right of screenshot).

No need for the Charles program to be running - just toggle on expert mode.

As I say, this may be widely known but I only just noticed so dropping it here just in case!

P.S. as an aside, I am getting decent speeds, but I never seem to get more than three bars of signal (more often only 1/2 bars) despite my router being outside in a waterproof box in line of sight of the router. Any thoughts / advice always welcomed!
Interesting! Can you change the APN ? What browser / phone are you using?
 
Apologies if I am late to the party on this but I just noticed that I have access to all settings by logging into the router via my phone and toggling on 'expert mode' (see bottom right of screenshot).

No need for the Charles program to be running - just toggle on expert mode.

And can you give the 2.4 and 5Ghz WiFi different SSIDs for example?
 
Hmm looks like I may have been a bit hasty in assuming it was 'all' settings as neither of your requests above are available i.e. can't seem to change APN or split the SSIDs.

Also, I feel like a bit of a wally now as I've noted that 'Expert Mode' is available when logging on from a desktop too...seems it is old news after all and I've somehow missed it!
 
Hmm looks like I may have been a bit hasty in assuming it was 'all' settings as neither of your requests above are available i.e. can't seem to change APN or split the SSIDs.

Also, I feel like a bit of a wally now as I've noted that 'Expert Mode' is available when logging on from a desktop too...seems it is old news after all and I've somehow missed it!
No worries, keep posting!
 
Hi all,

I have a figured out a way to unlock and enable hidden settings in Sercomm LTE2122GR. Its a very good router Cat18 600Mbps available for under £30 ( https://www.ebay.co.uk/itm/295560905697 )
I wanted to see if I can make it work with non-Three networks ( Vodafone in my case ) and saw that even though the LTE signal lights would be green, the internet light would keep on blinking and internet never worked.
As a few lights are controlled by modem itself and UI sensing signal strength with Vodafone SIM, I guessed that the modem itself is SIM unlocked but router might be forcing the 3internet APN for Three.

I thought of getting access to UART ( Serial ) connection and maybe change APN, but even after many hours of probing Voltages and UART receive pins, it was a dead end. Disappointingly I assembled the router back again and turned my focus to software attack.
To my amazement, it took only 20 minutes for this to happen.

While going through the in the Chrome Developer tools while Web interface was loaded, I searched for APN and landed on source where it checks about "usertype" being "enduser" or "admin". Even though I was logged in as admin but the console reported usertype returned was "enduser". This hinted of "superadmin" users being present. As the web ui is modern reactive UI, it configured itself based on details from a request


This json has usertype set to enduser and some settings screens disabled when corresponding value is "0".
That's it, I just started Charles Proxy which is a debugging MITM (Man in the middle) Proxy, created a rewrite rule to change the value of usertype from enduser to admin and change all "0" -> "1" before it reaches the browser, reloaded the web ui and voila all hidden settings are enabled and I am able to change APN to Vodafone and IT JUST WORKS !!
Surprisingly, it actually works better than my ZTE MF286D.

So anyone who wants to enable it, follow this

1. Install Charles Proxy ( https://www.charlesproxy.com/ )
2. Download Charles rewrite rules from https://gist.github.com/shantur/b1a9d9de83b9bc2f6410b76a1831a033
3. Goto Tools > Rewrite
4. Click Import and select the downloaded rule file
5. Check Enable Rewrite for both options.
6. Router won't complete setup if setting it up with a non-Three SIM. So both Rewrite options should be enabled.
7. Check Proxy is started in Proxy menu.
8. Check Proxy port from Proxy settings.
9. Now search how to setup proxy for your browser and set charles as the proxy either temporarily for all or just for 192.168.1.254
10. Open http://192.168.1.254 in your browser and login to router admin page.
11. If its the first time, just change the APN to what you want.
12. Reboot the router and disable the Wizard rewrite rule in Charles.
13. Once router has rebooted, open http://192.168.1.254 in browser again and login, the wizard will be completed now.
14. Be surprised with all the options.)

Change the IP in the urls and Charles file as per your setup.
Charles is a demo version and the same attack can be done with free MITMProxy. If someone does it please share the steps.

Time for the show

ChangeLog :

2023-05-03 - Changed location of Rewrite rules to Github
2023-05-01 - Updated Rewrite rules to handle first time setup with different SIM.

Hi, I have followed the instructions but am doing something wrong as despite having the rewrite xml as your image and have Charles running with traffic from the router, I effect no change. I am no expert so if there is any help available I would be obliged.
 
Hi, I have followed the instructions but am doing something wrong as despite having the rewrite xml as your image and have Charles running with traffic from the router, I effect no change. I am no expert so if there is any help available I would be obliged.
It might be easier to use the 'Burp Suite' method > here <
 
I found the Requestly method easy. I have the extension in my browser and enable it when needed.
 
Requestly method

Once you set up a free account and type in the code, you can install their browser extension and just enable it as and when you want to play with the extended Sercomm interface.
 
hi
is there any Firmware update for Sercomm LTE2122GR ?
this is my current :
Firmware version
4G+ Hub-3.8.00.09
Hardware Type & Version
4G+ Hub006
 
No. There are no issues with the current firmware and the router as a whole is no longer supplied by Three I believe.
 
I am sure they are somewhere but what is the EE APN please?
Access Point Name: everywhere

Username: eesecure

Password: secure

From memory, username and password are optional now, but can be used if your device insists it's necessary.
 
Top
Cheap BIG ISPs for 100Mbps+
Community Fibre UK ISP Logo
150Mbps
Gift: None
Virgin Media UK ISP Logo
Virgin Media £22.99
132Mbps
Gift: None
Vodafone UK ISP Logo
Vodafone £24.00 - 26.00
150Mbps
Gift: None
NOW UK ISP Logo
NOW £24.00
100Mbps
Gift: None
Plusnet UK ISP Logo
Plusnet £25.99
145Mbps
Gift: £50 Reward Card
Large Availability | View All
Cheapest ISPs for 100Mbps+
Gigaclear UK ISP Logo
Gigaclear £17.00
200Mbps
Gift: None
Community Fibre UK ISP Logo
150Mbps
Gift: None
Virgin Media UK ISP Logo
Virgin Media £22.99
132Mbps
Gift: None
Hey! Broadband UK ISP Logo
150Mbps
Gift: None
Youfibre UK ISP Logo
Youfibre £23.99
150Mbps
Gift: None
Large Availability | View All
Sponsored Links
The Top 15 Category Tags
  1. FTTP (6028)
  2. BT (3639)
  3. Politics (2721)
  4. Business (2440)
  5. Openreach (2405)
  6. Building Digital UK (2330)
  7. Mobile Broadband (2146)
  8. FTTC (2083)
  9. Statistics (1902)
  10. 4G (1816)
  11. Virgin Media (1764)
  12. Ofcom Regulation (1582)
  13. Fibre Optic (1467)
  14. Wireless Internet (1462)
  15. 5G (1407)
Sponsored

Copyright © 1999 to Present - ISPreview.co.uk - All Rights Reserved - Terms  ,  Privacy and Cookie Policy  ,  Links  ,  Website Rules