ZTE MF910 Wireless Router reviewed
Sunday, March 1. 2015
I had a chance to setup a modern 4G/3G/2G router. Of course I took pics and share the details here!
This is what a ZTE MF910 looks like:
Pretty much the first thing that comes to my mind is: "It's a cell phone!" Yes, indeed. It is. It is an Android phone. My guess is, it is 99% of a cell phone when compared to an Android in your pocket. It is small, it has an USB-charger, runs hours from a battery. It is shiny (pretty difficult to get decent pictures of it). It has a display (no touching or anything expensive). And it costs 99,- €. There is very little differentiating it, except that it doesn't have a speaker and a microphone. I didn't pop the hood of it (that thing isn't mine, I was just helping to set it up), but I'm thinking it has all the chips and electronics a phone would have.
Screen will indicate connection type (2G/3G/4G), bars, Internet status (ok, both arrows up and down), Wi-Fi enabled, how many clients are connected to the Wi-Fi, battery charge level, operator name, cumulative time connected and the cumulative transmitted bytes.
On the back there are out-of-the-box defaults and mandatory IMEI-information. The TAC-code for this one is 86415402 and I couldn't find it from any TAC databases. Must be quite a new one. What I didn't find is how to replace the battery. I guess you cannot, it is like a cell phone. It doesn't feel hot or anything when running, looks like the electronics design is also modern. It puts all the electrons where you'd expect them to go, not to dissipate heat.
Here is a clear difference to a phone:
There are two antenna connectors (TS9) on the sides. As all LTE equipment always has 2 antennas (your phone does, you just won't see them), there needs to be connectors for both of them. The intended purpose for this is to convert cellular connection into Wi-Fi. As sometimes the cell network connection is poor, adding a proper antenna (or two) can make a difference. Power button has one extra feature including the obvious one. If you press it shortly, it will display the default WLAN SSID and password on the screen. Funny thing: if you change them, the screen won't display the new ones. On the as-expected, there is a mini-SIM -slot and mini-A USB for the charger.
The antenna connector is a quirky one:
I couldn't find anything to connect to it. Any typical small appliance (like Huawei USB-sticks) have CRC9-connector, or the bigger routers (like Huawei B593) have SMA-connectors. I guess the new TS9 is suiting better for some reason.
When the SIM-card in inserted, power button pressed and box is up and running, it connects automatically to internet. It distributes an IP-address to any client devices and enables the management web-console. It looks like this:
There is a decent selection of langauges for the GUI:
And the top right corner status indicator is good one:
It provides a lot of information without need to login. This is what it looks like once in:
There is no need to look for Wi-Fi settings. They are right there after a login. In general I really love their approach, lot of useful features and really well thought web-GUI implemented. Also the existence of 5 GHz WLAN tells about a modern design. A while ago only 2,4 GHz existed in routers such as this.
The Internet connection details are:
APN I didn't touch, it just worked. Network mode (2G/3G/4G) may be necessary if reception has issues. The most important thing is, that this box has a built-in freq lock in it. No need of hacking or any quirks. This is by far the most commonly asked question nowadays, how do you lock B593 into a frequency. With this el-cheapo box, setting is right there! Nice.
I also love the status screens:
Lot of relevant information right at your screen! This is exactly what everybody else should be doing. Unfortunately the network status screen is optimized heavily for LTE-connections and on UMTS it won't tell much.
As a conclusion I have to recommend this cheaply built piece of plastic for any router needs. It certainly is worth the money and has just the right features in it. The only thing that worries me is the constant charging: will it survive future years? I don't care if the thing wouldn't run from the battery, but will the charger alone be enough to run it?
haing on :
carrier lock
i asked .. how to unlock mf910...
can u help me?
thanks
Jari Turkia on :
Just buy one from Finland, they're unlocked.
Niko Hallikainen on :
Jari Turkia on :
What I do know, is that after authentication there are some details in HTML-data. I'm not sure if an AJAX API exists. The UI looks modern enough for software developers to use such technologies, meaning, that any information would be made available programmatically.
Antony on :
I would ask you which firmware is that in the photos? Is it generic ZTE or operator's own?
Thanks.
Jari Turkia on :
Unlike many many countries on this globe, in Finland you can actually walk to a store (lot of choice for that) and buy a piece of hardware, that telcos sell to their customers with ridiculous contracts. All of them are unlocked and any SIM will do the job for you. Personally I find it amusing, that in pretty much everywhere else telcos have full control of the hardware YOU own. But that's an another story.
João Alexandre Madail on :
It's just a different approach to the market.
YoNevelt on :
Jari Turkia on :
Gabriel on :
cmvr on :
Thanks
ZecretW on :
Jari Turkia on :
mayayah on :
how not to display " password" on the screen using zte mf 910
Jari Turkia on :
John Christian on :
marco on :
The only thing is that I use a Lycamobile as provider which doesn't like thethering... It's in the TTL protocol which is standard 64, with my linux machines thats no problem because I can change that...
But I want to change the TTL in the megafone LTE150 so my phones which are not rooted can also connect to internet via WIFI...
Anyone has an idea how to change the TTL in the LTE150?
I have a feeling that the HTTP acces has some secret page where you can service the thing, or maybe I can somehow Telnet into it so i can figure out how to change it via that way...
Jari Turkia on :
If you find anything interesting, please share.
Owen on :
Now, I preface all of this by saying that my MF910 is a rebranded Telstra (shitty Aussie telco) product. That said, I have over the last few days digested the Telstra, Vodafone and 'base' ZTE firmwares for this device and despite having their own custom logos, WebUIs and the usual corporate customizations, they all seem to be pretty much the same. The firmwares that I looked at are all LITTERED with open source GPLv2 licensed software, including but not limited to the bloody kernel! The core oe is Linux 1.4, the kernel is QCom Open Source GPL and most firmware versions come jam-packed with Busybox (incl. Drop Bear), as well as FTPd, Bitbake, Poky, Bison and a bunch of our other fave ARMv7 Linux open source packages! Are the telcos profiting off these GPL beauties providing the derived firmware source to us? Ofc not. But I found that, if pushed (i.e. give me or I will highlight your infringement to the public), they will cough up their corporate source code haha! I'm pouring through a 4.5gig source for the Telstra version of the firmware as we speak, complete with embarrassing dev comments accidentally left behind. Anyway, on to the backdoor...
STEP 1: Connect your MF910 to your computer via USB and power on the MF910.
STEP 2: Use your browser to login to the usual WebUI - 192.168.0.1 for me - default password is 'password' *face palm*. You must login to the WebUI or the next step will not work.
STEP 3: (Yes, you were right buddy!) After logging in, go the following URL: http://192.168.0.1/goform/goform_set_cmd_process?goformId=USB_MODE_SWITCH&usb_mode=6 - apparently the MF910 has 9 device modes, mode 6 puts the MF910 into ADB mode so that it can be debugged/interfaced via the Android Debugging Bridge. Soon as you go to the URL you will see "Success" in your browser and notice your USB connection with the MF910 'reset' (like you unplugged and re-plugged the device).
STEP 4: Assuming you have the ADB SDK installed on your computer (SDK - platform tools) use CMD (Windows) or your Linux Terminal to issue the following commands:
- adb start-server
- adb usb
- adb devices
- adb shell
Assuming the USB connection between your MF910 and your computer is good, you will now be met with the MF910's bash prompt - Linux 1.4>.
You are in. Issue the whoami command... root. Issue mount command... holy hell, everything is mounted RW! Busybox and a bunch of other stuff is pre-installed. I could get FTPd server to work immediately allowing easy access to the thing for downloading/uploading files. Oh, the root password for FTPd (on port 21) was "public" - *facepalm again*. For whatever reason Dropbear SSH never worked for me so I just installed OpenSSH on it haha.
From memory you have about 45mb of space to play with in the rootfs, the other partition sectors take up another approx. 40mb. It's bugger all, unfortunately, but hey, i've seen worse.
In terms of 'unlocking' these babies from their carrier specific SIM restrictions, I just used ADB to sideload flash ZTE's original (unlocked) firmware and I can use any SIM in it now. ZTE are actually awesome - you can download tar balls of all their ZTE's firmware (including the source! good on you, ZTE!) from their website.
Hope this helps you guys Happy hacking y'all!
Tim on :
So nice to see a fellow Aussie make such a contribution.
I have a generic one of these which seemed to have s/w from somewhere in Scandinavia on it.
One question - do you know how tell which LTE bands are activated on it and/or activate something which isn't?
Thanks
T
Barth on :
I would like to ask you where you found the ZTE's original (unlocked) firmware.
Regards
Barth
Jari Turkia on :
Also the Telcos are lazy and don't want to spend any time doing firmware modding. They just slab the factory default into boxes and sell them.
Alirio on :
Jari Turkia on :
Alirio on :
Jari Turkia on :
brayn on :
can you please share the original firmware for zte mf910 please?
Brendan on :
Jari Turkia on :
Carlos on :
Jicaraca on :
I am wondering, flashing a china ROM will expand the freq that can be used to the rom region ?! Or freq are hardware limited. I have a Portuguese specific firmware unlocked but frequency wise is limited.
Can I change enabled frequency's by flashing ? Cant find info in this issue.
Would appreciate your insight !!
Compliments !!
Jari Turkia on :
MccCarron on :
Mayor on :
Wozz Wunndering on :
(We bought this 5 years ago from a non Telstra shop)
Is it possible to unlock it to use other service providers other than Telstra?
Is the methodology the same as here?
cashin on :
I just ssh'ed in my variant device mf910+ via the adb debug mode change trick.