Orange Spanien Livebox 6+ (ERV33AX349B-LT) — Gesperrter Router ohne Adminzugang, suche Lösungen

[Anon-livebox]

Hello everybody,


I'm dealing with one right now Livebox 6 + Router (model: ERV33AX349B-LT, hardware ID: ARLT210C8773), originally from Orange Spain was provided. Unfortunately, the device is so severely restricted that it is practically unusable outside the orange network.

​

• Commercial name: Livebox 6 +
• Technical model: ARLT210C8773
• Internal device name: ARLTLBPLUG
• Firmware version: ARPLUS6-sp-03.03.01.0270
• Boot loader: SAHBL 20.99.14
• Hardware version: ARLTLBPLU61.0.0
• Provider: Orange Spain (not Orange France!)

What I've found and tried so far:

• Only FTP access possible, and only with anonymous or restricted accounts. No root or admin access available.
• SSH, Telnet and other terminal access are completely deactivated.
• No access to administrative functions – the user interface offers only very limited access.
• I could Make the WAN configuration area visible via DevTools, but as soon as I try to click on it, the page is immediately loaded back to the homepage – absolutely useless.
• A factory reset does not bring any changes or improvements.
• The firmware blocks all attempts to gain deeper control or use hidden functions.
• The router is outside of Orange Spain practically just a piece of electronic waste.

Important clarifications:

• It is the version of Orange Spain, not France, Belgium etc.
• I am no professional or hacker, but simply someone with a little technical curiosity and basic knowledge.
• Orange Spain's official support refuses to help because I am no longer an active customer.

Important note for everyone who is thinking about modifications:


Although you might think that UART / JTAG the way to activation is probably futile with this device. The Chipsets used are proprietary and use closed drivers and firmware blobs. That means: If you flash incompatible firmware, you risk total damage – a real brick, not only in a figurative sense.


Such devices are not suitable for OpenWRT or other custom firmwareunless someone has developed a compatible solution especially for this model (and I am currently not aware of any of this).

---

What I'm looking for:​

• One way, only partially extended accesswithout destroying the device.
• Methods to Unlock WAN settings such as PPPoE or Bridge Mode.
• Tools, exploits or workarounds to circumvent the firmware restrictions.
• Experience from the community – has anyone been able to use this model successfully outside the Orange network?

Thanks in advance for any hint.

 

[Ohrenschmalz]

Maybe you can gain serial access like here https://openwrt.org/inbox/toh/arcadyan/astoria/prv3399b-e-lt described?
Not exeactly the same model, but worth a try...

 

[Anon-livebox]

Vollzitat gemäß Boardregeln https://www.ip-phone-forum.de/threads/ip-phone-forum-regeln.297224/ entfernt by stoney

I was hoping there would be some kind of exploit that would enable either ssh or telnet without opening the device because it has a usb 3.0 at the back. Fritzbox has a similar exploit. I don't want to open it. I'd rather have an exploit to hack the web ui of the router or something. That would be clean and somewhat doable. Also, there's no documentation on this specific model which is weird. I also tried multiple times to contact arcadyan and orange spain but they ignored me. It's like they don't care about causing electronic waste all over the world.

 

[Ohrenschmalz]

I would dump this shitty thing...

 

[Anon-livebox]

I would dump this shitty thing...

I get what you're saying. I would burn it even, but wouldn't it be worth it to see the look on their faces when you actually make use of it. They lock shit down and think no one has the ability to unlock it but them. It makes you want to unlock it even more and rub it in their faces, haha.

 

[Ohrenschmalz]

You could open it for serial access, afterwards you can still burn it

 

[Anon-livebox]

You could open it for serial access, afterwards you can still burn it

Actually there were some guys that open it up and tried to gain access through serial like you said but they weren't successful. Here are some links:

https://foro.elhacker.net/hardware/...ible_el_acceso_root_del_router-t517891.0.html

Acceso a los logs del router Livebox 6+ Arcadyan ERV33AX349B-LT

bandaancha.eu

 

[Ohrenschmalz]

Never seen such a log, does not look like a typical bootlog...more than a log when system is already running.
With serial connected at boottime, you can typically stop U-Boot and do something else. If you´re interested, make it so...