Introduction⌗

Because of my fable for network technology and the wish to gather more in-depth knowledge on the OSS firewall solution OPNsense, I planned a multi-WAN setup. One of the upstream gateways should be of course a ZTE MC801A HyperBox 5G [ztedevices.com] router as a fallback connection.

Specification Description
Network NSA&SA (5G: n41/78/79/1/28) / (4G: B1/3/5/8/28/34/39/40)
MIMO 5G+LTE: (sub6G DL: 4MIMO) / (4G DL: 8layers) / (LTE: 4MIMO on 5CA)
Broadband (MHz) 200M
Platform SDX55+QCA6391
Modulation DL 256QAM, UL 256QAM
LTE+5G EN-DC peak rate 4.6Gbps
Dimensions 182 x 124 x 70mm
Wi-Fi Wi-Fi 6, 2.4G&5G dual band, 2x2 MIMO, 1.775GBbps, 32 users
Antenna 3.5GHz band max gain up to 9dBi (optional)
Interface Led: power, Wi-Fi, network, signal x3

For those who are interested in internal photos: ZTE MC801A 5G CPE Internal Photos [fccid.io]

In this post I don’t even want to go into detail about the firewall configuration, but rather about the ZTE 5G router I’m using and the fact that to my amazement no one has written a monitoring exporter for this device series yet.

Since I already run a very well integrated Prometheus monitoring stack with Grafana as frontend, the 5G router should expose metrics to Prometheus using its own exporter. I also had to design a new Grafana dashboard from scratch, since I couldn’t find a comparable one for reuse on the Internet.

In the following I will describe the structure of the ZTE API and introduce the exporter including the dashboard.

Login Procedure⌗

Since the web frontend of the ZTE MC801A only supports unencrypted HTTP, the software developers came up with a small crypto challenge for the login. Because only a single active login session is possible, this challenge can be considered “more secure” than a completely unencrypted password transfer. Nevertheless, this whole construct is more than adventurous and outdated for a company that offers enterprise network technology and smartphones.

The important code part is located in the javascript service.js and is a little bit obfuscated as is often the case.


function de() {
  function e(e, t) {
    var r = hr({
      nv: 'LD'
    }).LD;
    return {
      isTest: gi,
      goformId: 'LOGIN',
      password: '2' == n.WEB_ATTR_IF_SUPPORT_SHA256 ? paswordAlgorithmsCookie(paswordAlgorithmsCookie(e.password) + r) : '1' == n.WEB_ATTR_IF_SUPPORT_SHA256 ? paswordAlgorithmsCookie(Base64.encode(e.password)) : Base64.encode(e.password)
    }
  }
}

Actually the code is already readable. But since I wanted to experiment a bit with GPT-4, I had the snippet rewritten in human readable form.


function loginFormBuilder() {
  // Inner function to build login form data
  function buildLoginForm(userData, config) {
    // Fetch the LD token using a function or object named 'hr'
    var ldToken = hr({ nv: 'LD' }).LD;

    // Prepare the login form data
    return {
      isTest: config.isTest,
      goformId: 'LOGIN',
      password: '2' == config.sha256Support
        ? applyPasswordAlgorithm(applyPasswordAlgorithm(userData.password) + ldToken)
        : '1' == config.sha256Support
          ? applyPasswordAlgorithm(Base64.encode(userData.password))
          : Base64.encode(userData.password)
    };
  }

  // Return the inner function for external use
  return buildLoginForm;
}

So the login is done in the following steps:

  1. A time-limited LD token is sent to the client
  2. Client processes the challenge sha256_encode(sha256_encode(ZTE_PASSWORD) + ld_token)
  3. A result code and a cookie are sent to the client

There is a fallback if the web browser doesn’t support sha256 for whatever reason. Then the password will be simply base64 encoded and the LD token is not used at all. Really?

API Endpoints⌗

Let’s talk about the API instead. Under the hood runs a full blown Android operating system. There are firmware images circulating on the Internet that are completely unencrypted, in line with the login procedure. At least everyone can audit their device… Whoopsie!

Thanks to the firmware images, I was able to pick apart the API a little better and dig out hidden endpoints.

Objectively, there is only one endpoint at /goform/goform_get_cmd_process, which works by accepting a GET request with one or multiple parameters. However, not all parameters can be queried at this endpoint at the same time. Because the backend, which is partly written in Bash, has internal limitations.

I have not tried all combinations and therefore there may be duplications in the sample queries below.

WiFi Access Point Status

Following queries return information about all configured wireless access points. Each access point is represented as an object with various attributes such as SSID, authentication mode, encryption type, password, and more.

Oh yes! It returns the base64 encoded AP password…


curl 'http://zte-mc801a.zaage.it/goform/goform_get_cmd_process?isTest=false&cmd=queryAccessPointInfo' -H 'Referer: http://zte-mc801a.zaage.it/'


{
  "ResponseList": [
    {
      "ChipIndex": "0",
      "AccessPointIndex": "0",
      "AccessPointSwitchStatus": "1",
      "SSID": "ZTE_XXXXXX",
      "ApMaxStationNumber": "30",
      "ApIsolate": "0",
      "AuthMode": "WPA2PSK",
      "EncrypType": "CCMP",
      "Password": "xxxxxxxxxxxxxx",
      "QrImageUrl": "/etc_rw/ztembb/wlan/qrcode/wifi_chip1_ssid1_ssid_qrcode.png",
      "ApBroadcastDisabled": "0",
      "CurrentStationNumber": "0",
      "CountryCode": "DE",
      "WirelessMode": "7",
      "Channel": "0",
      "BandWidth": "2",
      "Band": "b",
      "SSIDPMF": "",
      "mbss_isolate_webui": "",
      "mbss_isolate_webui_5G": "",
      "GuestSSIDActiveTime": ""
    },
    {
      "ChipIndex": "0",
      "AccessPointIndex": "1",
      "AccessPointSwitchStatus": "0",
      "SSID": "ZTE_XXXXXX_Guest",
      "ApMaxStationNumber": "30",
      "ApIsolate": "0",
      "AuthMode": "WPA2PSK",
      "EncrypType": "CCMP",
      "Password": "xxxxxxxxxxxxx",
      "QrImageUrl": "/etc_rw/ztembb/wlan/qrcode/wifi_chip1_ssid2_ssid_qrcode.png",
      "ApBroadcastDisabled": "0",
      "CurrentStationNumber": "0",
      "CountryCode": "DE",
      "WirelessMode": "7",
      "Channel": "0",
      "BandWidth": "2",
      "Band": "b",
      "SSIDPMF": "",
      "mbss_isolate_webui": "",
      "mbss_isolate_webui_5G": "",
      "GuestSSIDActiveTime": ""
    },
    {
      "ChipIndex": "0",
      "AccessPointIndex": "2",
      "AccessPointSwitchStatus": "",
      "SSID": "",
      "ApMaxStationNumber": "",
      "ApIsolate": "",
      "AuthMode": "",
      "EncrypType": "",
      "Password": "",
      "QrImageUrl": "",
      "ApBroadcastDisabled": "",
      "CurrentStationNumber": "",
      "CountryCode": "",
      "WirelessMode": "",
      "Channel": "",
      "BandWidth": "",
      "Band": "",
      "SSIDPMF": "",
      "mbss_isolate_webui": "",
      "mbss_isolate_webui_5G": "",
      "GuestSSIDActiveTime": ""
    },
    {
      "ChipIndex": "0",
      "AccessPointIndex": "3",
      "AccessPointSwitchStatus": "",
      "SSID": "",
      "ApMaxStationNumber": "",
      "ApIsolate": "",
      "AuthMode": "",
      "EncrypType": "",
      "Password": "",
      "QrImageUrl": "",
      "ApBroadcastDisabled": "",
      "CurrentStationNumber": "",
      "CountryCode": "",
      "WirelessMode": "",
      "Channel": "",
      "BandWidth": "",
      "Band": "",
      "SSIDPMF": "",
      "mbss_isolate_webui": "",
      "mbss_isolate_webui_5G": "",
      "GuestSSIDActiveTime": ""
    },
    {
      "ChipIndex": "1",
      "AccessPointIndex": "0",
      "AccessPointSwitchStatus": "1",
      "SSID": "ZTE_XXXXXX_5G",
      "ApMaxStationNumber": "30",
      "ApIsolate": "0",
      "AuthMode": "WPA2PSK",
      "EncrypType": "CCMP",
      "Password": "xxxxxxxxxxxxxxx",
      "QrImageUrl": "/etc_rw/ztembb/wlan/qrcode/wifi_chip2_ssid1_ssid_qrcode.png",
      "ApBroadcastDisabled": "0",
      "CurrentStationNumber": "0",
      "CountryCode": "DE",
      "WirelessMode": "8",
      "Channel": "0",
      "BandWidth": "4",
      "Band": "a",
      "SSIDPMF": "",
      "mbss_isolate_webui": "",
      "mbss_isolate_webui_5G": "",
      "GuestSSIDActiveTime": ""
    },
    {
      "ChipIndex": "1",
      "AccessPointIndex": "1",
      "AccessPointSwitchStatus": "0",
      "SSID": "ZTE_5GCPE_",
      "ApMaxStationNumber": "30",
      "ApIsolate": "0",
      "AuthMode": "WPA2PSK",
      "EncrypType": "CCMP",
      "Password": "xxxxxxxxxxxxxxxxx",
      "QrImageUrl": "",
      "ApBroadcastDisabled": "0",
      "CurrentStationNumber": "0",
      "CountryCode": "DE",
      "WirelessMode": "8",
      "Channel": "0",
      "BandWidth": "4",
      "Band": "a",
      "SSIDPMF": "",
      "mbss_isolate_webui": "",
      "mbss_isolate_webui_5G": "",
      "GuestSSIDActiveTime": ""
    },
    {
      "ChipIndex": "1",
      "AccessPointIndex": "2",
      "AccessPointSwitchStatus": "",
      "SSID": "",
      "ApMaxStationNumber": "",
      "ApIsolate": "",
      "AuthMode": "",
      "EncrypType": "",
      "Password": "",
      "QrImageUrl": "",
      "ApBroadcastDisabled": "",
      "CurrentStationNumber": "",
      "CountryCode": "",
      "WirelessMode": "",
      "Channel": "",
      "BandWidth": "",
      "Band": "",
      "SSIDPMF": "",
      "mbss_isolate_webui": "",
      "mbss_isolate_webui_5G": "",
      "GuestSSIDActiveTime": ""
    },
    {
      "ChipIndex": "1",
      "AccessPointIndex": "3",
      "AccessPointSwitchStatus": "",
      "SSID": "",
      "ApMaxStationNumber": "",
      "ApIsolate": "",
      "AuthMode": "",
      "EncrypType": "",
      "Password": "",
      "QrImageUrl": "",
      "ApBroadcastDisabled": "",
      "CurrentStationNumber": "",
      "CountryCode": "",
      "WirelessMode": "",
      "Channel": "",
      "BandWidth": "",
      "Band": "",
      "SSIDPMF": "",
      "mbss_isolate_webui": "",
      "mbss_isolate_webui_5G": "",
      "GuestSSIDActiveTime": ""
    }
  ]
}

Temperature and Power

Next query provides temperature and power-related information on the 5G modem, power amplifier and system board.


curl 'http://zte-mc801a.zaage.it/goform/goform_get_cmd_process?isTest=false&cmd=wifi_chip_temp,
therm_pa_level,
therm_pa_frl_level,
therm_tj_level,
pm_sensor_pa1,
pm_sensor_mdm,
pm_modem_5g&multi_data=1' -H 'Referer: http://zte-mc801a.zaage.it/'


{
  "wifi_chip_temp": "",
  "therm_pa_level": "0",
  "therm_pa_frl_level": "0",
  "therm_tj_level": "0",
  "pm_sensor_pa1": "-40",
  "pm_sensor_mdm": "63",
  "pm_modem_5g": "60"
}

Device Information

This is one of the larger queries which gathers a range of data from following categories:

  • WiFi Settings: It includes details about the WiFi configuration, such as SSID, authentication mode, and so on. It also indicates the maximum number of allowed devices to connect.
  • Network Information: It provides information about the network type and includes WAN and LAN IP addresses, along with IPv6 configuration details.
  • Device Information: It contains details about the device’s hardware version, firmware versions, and IMEI.

curl 'http://zte-mc801a.zaage.it/goform/goform_get_cmd_process?isTest=false&cmd=wifi_onoff_state,
guest_switch,
wifi_chip1_ssid2_max_access_num,
m_SSID2,
wifi_chip2_ssid2_max_access_num,
wifi_chip1_ssid1_wifi_coverage,
apn_interface_version,
m_ssid_enable,
imei,
network_type,
rssi,
rscp,
lte_rsrp,
imsi,
sim_imsi,
cr_version,
wa_version,
hardware_version,
web_version,
wa_inner_version,
wifi_chip1_ssid1_max_access_num,
wifi_chip1_ssid1_ssid,
wifi_chip1_ssid1_auth_mode,
wifi_chip1_ssid1_password_encode,
wifi_chip2_ssid1_ssid,
wifi_chip2_ssid1_auth_mode,
m_HideSSID,
wifi_chip2_ssid1_password_encode,
wifi_chip2_ssid1_max_access_num,
lan_ipaddr,
lan_ipaddr,
wlan_mac_address,
msisdn,
LocalDomain,
wan_ipaddr,
static_wan_ipaddr,
ipv6_wan_ipaddr,
ipv6_pdp_type,
ipv6_pdp_type_ui,
pdp_type,
pdp_type_ui,
opms_wan_mode,
opms_wan_auto_mode,
ppp_status,
Z5g_snr,
Z5g_rsrp,
wan_lte_ca,
lte_ca_pcell_band,
lte_ca_pcell_bandwidth,
lte_ca_scell_band,
lte_ca_scell_bandwidth,
lte_ca_pcell_arfcn,
lte_ca_scell_arfcn,
lte_multi_ca_scell_info,
wan_active_band,
wifi_onoff_state,
guest_switch,
wifi_chip1_ssid2_max_access_num,
wifi_chip2_ssid2_max_access_num,
wifi_chip1_ssid1_wifi_coverage,
wifi_chip1_ssid1_max_access_num,
wifi_chip1_ssid1_ssid,
wifi_chip1_ssid1_auth_mode,
wifi_chip1_ssid1_password_encode,
wifi_chip2_ssid1_ssid,
wifi_chip2_ssid1_auth_mode,
wifi_chip2_ssid1_password_encode,
wifi_chip2_ssid1_max_access_num,
wifi_chip1_ssid2_ssid,
wifi_chip2_ssid2_ssid,
wifi_chip1_ssid1_switch_onoff,
wifi_chip2_ssid1_switch_onoff,
wifi_chip1_ssid2_switch_onoff,
wifi_chip2_ssid2_switch_onoff,
Z5g_SINR,
station_ip_addr,
build_version_time,
imei_sv,
multi_pdns_wan_ipaddr_2,
multi_pdns_ipv6_wan_ipaddr_2&multi_data=1' -H 'Referer: http://zte-mc801a.zaage.it/'


{
  "wifi_onoff_state": "0",
  "guest_switch": "",
  "wifi_chip1_ssid2_max_access_num": "30",
  "m_SSID2": "",
  "wifi_chip2_ssid2_max_access_num": "30",
  "wifi_chip1_ssid1_wifi_coverage": "short_mode",
  "apn_interface_version": "2",
  "m_ssid_enable": "",
  "imei": "00000000000000000",
  "network_type": "ENDC",
  "rssi": "",
  "rscp": "",
  "lte_rsrp": "-105",
  "imsi": "",
  "sim_imsi": "0000000000000000000",
  "cr_version": "",
  "wa_version": "",
  "hardware_version": "MC801AHW-1.0.0",
  "web_version": "WEB_DETMOMC801AV1.0.0B14",
  "wa_inner_version": "MC801AV1.0.0B16",
  "wifi_chip1_ssid1_max_access_num": "30",
  "wifi_chip1_ssid1_ssid": "ZTE_XXXXXXX",
  "wifi_chip1_ssid1_auth_mode": "WPA2PSK",
  "wifi_chip1_ssid1_password_encode": "xxxxxxxxxxxx",
  "wifi_chip2_ssid1_ssid": "ZTE_XXXXXXX_5G",
  "wifi_chip2_ssid1_auth_mode": "WPA2PSK",
  "m_HideSSID": "",
  "wifi_chip2_ssid1_password_encode": "xxxxxxxxxxxx",
  "wifi_chip2_ssid1_max_access_num": "30",
  "lan_ipaddr": "192.168.0.5",
  "wlan_mac_address": "xx:xx:xx:xx:xx:xx",
  "msisdn": "49151xxxxxxx",
  "LocalDomain": "",
  "wan_ipaddr": "10.21.174.92",
  "static_wan_ipaddr": "",
  "ipv6_wan_ipaddr": "2a01:0598:9993:1c82:xxxx:xxxx:xxxx:xxxx",
  "ipv6_pdp_type": "IPv4v6",
  "ipv6_pdp_type_ui": "",
  "pdp_type": "IPv4v6",
  "pdp_type_ui": "IPv4v6",
  "opms_wan_mode": "LTE_BRIDGE",
  "opms_wan_auto_mode": "AUTO_LTE_GATEWAY",
  "ppp_status": "ipv4_ipv6_connected",
  "Z5g_snr": "",
  "Z5g_rsrp": "-96",
  "wan_lte_ca": "",
  "lte_ca_pcell_band": "",
  "lte_ca_pcell_bandwidth": "",
  "lte_ca_scell_band": "",
  "lte_ca_scell_bandwidth": "",
  "lte_ca_pcell_arfcn": "",
  "lte_ca_scell_arfcn": "",
  "lte_multi_ca_scell_info": "",
  "wan_active_band": "LTE BAND 3",
  "wifi_chip1_ssid2_ssid": "ZTE_XXXXXX_Guest",
  "wifi_chip2_ssid2_ssid": "ZTE_5GCPE_",
  "wifi_chip1_ssid1_switch_onoff": "1",
  "wifi_chip2_ssid1_switch_onoff": "1",
  "wifi_chip1_ssid2_switch_onoff": "0",
  "wifi_chip2_ssid2_switch_onoff": "0",
  "Z5g_SINR": "19.5",
  "station_ip_addr": "0",
  "build_version_time": "12/12/2022",
  "imei_sv": "F",
  "multi_pdns_wan_ipaddr_2": "",
  "multi_pdns_ipv6_wan_ipaddr_2": ""
}


curl 'http://zte-mc801a.zaage.it/goform/goform_get_cmd_process?isTest=false&multi_data=1&cmd=wifi_sta_connection,ap_station_mode,m_ssid_enable' -H 'Referer: http://zte-mc801a.zaage.it/'


{
  "wifi_sta_connection": "0",
  "ap_station_mode": "wifi_pref",
  "m_ssid_enable": ""
}

Network Information

As the title says, only network (LAN/WAN/CELL) related data is returned. It is also possible to retrieve a list of all connected devices.


curl 'http://zte-mc801a.zaage.it/goform/goform_get_cmd_process?multi_data=1&isTest=false&sms_received_flag_flag=0&sts_received_flag_flag=0&cmd=modem_main_state,
pin_status,
opms_wan_mode,
opms_wan_auto_mode,
loginfo,
new_version_state,
current_upgrade_state,
is_mandatory,
wifi_dfs_status,
battery_value,
ppp_dial_conn_fail_counter,
wifi_chip1_ssid1_auth_mode,
wifi_chip2_ssid1_auth_mode,
signalbar,
network_type,
network_provider,
ppp_status,
simcard_roam,
spn_name_data,
spn_b1_flag,
spn_b2_flag,
wifi_onoff_state,
wifi_chip1_ssid1_ssid,
wifi_chip2_ssid1_ssid,
wan_lte_ca,
monthly_tx_bytes,
monthly_rx_bytes,
pppoe_status,
dhcp_wan_status,
static_wan_status,
rmcc,
rmnc,
mdm_mcc,
mdm_mnc,
EX_SSID1,
sta_ip_status,
EX_wifi_profile,
m_ssid_enable,
RadioOff,
wifi_chip1_ssid1_access_sta_num,
wifi_chip2_ssid1_access_sta_num,
lan_ipaddr,
station_mac,
wifi_access_sta_num,
battery_charging,
battery_vol_percent,
battery_pers,
realtime_tx_bytes,
realtime_rx_bytes,
realtime_time,
realtime_tx_thrpt,
realtime_rx_thrpt,
monthly_time,
date_month,
data_volume_limit_switch,
data_volume_limit_size,
data_volume_alert_percent,
data_volume_limit_unit,
roam_setting_option,
upg_roam_switch,
ssid,
wifi_enable,
wifi_5g_enable,
check_web_conflict,
dial_mode,
privacy_read_flag,
is_night_mode,
vpn_conn_status,
wan_connect_status,
sms_received_flag,
sts_received_flag,
sms_unread_num,
wifi_chip1_ssid2_access_sta_num,
wifi_chip2_ssid2_access_sta_num' -H 'Referer: http://zte-mc801a.zaage.it/'


{
  "modem_main_state": "modem_init_complete",
  "pin_status": "1",
  "opms_wan_mode": "LTE_BRIDGE",
  "opms_wan_auto_mode": "AUTO_LTE_GATEWAY",
  "loginfo": "ok",
  "new_version_state": "version_idle",
  "current_upgrade_state": "fota_idle",
  "is_mandatory": "",
  "wifi_dfs_status": "",
  "battery_value": "100",
  "ppp_dial_conn_fail_counter": "0",
  "wifi_chip1_ssid1_auth_mode": "WPA2PSK",
  "wifi_chip2_ssid1_auth_mode": "WPA2PSK",
  "signalbar": "4",
  "network_type": "ENDC",
  "network_provider": "Telekom.de",
  "ppp_status": "ipv4_ipv6_connected",
  "simcard_roam": "Home",
  "spn_name_data": "00000000000000000000000000000000000000000000000000",
  "spn_b1_flag": "0",
  "spn_b2_flag": "0",
  "wifi_onoff_state": "0",
  "wifi_chip1_ssid1_ssid": "ZTE_XXXXXX",
  "wifi_chip2_ssid1_ssid": "ZTE_XXXXXX_5G",
  "wan_lte_ca": "ca_deactivated",
  "monthly_tx_bytes": "2009566748",
  "monthly_rx_bytes": "53458759605",
  "pppoe_status": "ppp_disconnected",
  "dhcp_wan_status": "0",
  "static_wan_status": "",
  "rmcc": "262",
  "rmnc": "1",
  "mdm_mcc": "262",
  "mdm_mnc": "01",
  "EX_SSID1": "",
  "sta_ip_status": "disconnect",
  "EX_wifi_profile": "",
  "m_ssid_enable": "",
  "RadioOff": "0",
  "wifi_chip1_ssid1_access_sta_num": "0",
  "wifi_chip2_ssid1_access_sta_num": "0",
  "lan_ipaddr": "192.168.0.5",
  "station_mac": "",
  "wifi_access_sta_num": "0",
  "battery_charging": "0",
  "battery_vol_percent": "100",
  "battery_pers": "4",
  "realtime_tx_bytes": "429475373",
  "realtime_rx_bytes": "8320583139",
  "realtime_time": "69771",
  "realtime_tx_thrpt": "485",
  "realtime_rx_thrpt": "468",
  "monthly_time": "926656",
  "date_month": "20230801",
  "data_volume_limit_switch": "0",
  "data_volume_limit_size": "",
  "data_volume_alert_percent": "",
  "data_volume_limit_unit": "",
  "roam_setting_option": "off",
  "upg_roam_switch": "0",
  "ssid": "",
  "wifi_enable": "",
  "wifi_5g_enable": "0",
  "check_web_conflict": "ok",
  "dial_mode": "auto_dial",
  "privacy_read_flag": "1",
  "is_night_mode": "0",
  "vpn_conn_status": "disconnected",
  "wan_connect_status": "pdp_connected",
  "sms_received_flag": "",
  "sts_received_flag": "",
  "sms_unread_num": "0",
  "sms_dev_unread_num": "0",
  "sms_sim_unread_num": "0",
  "wifi_chip1_ssid2_access_sta_num": "0",
  "wifi_chip2_ssid2_access_sta_num": "0"
}


curl 'http://zte-mc801a.zaage.it/goform/goform_get_cmd_process?isTest=false&cmd=lan_station_list' -H 'Referer: http://zte-mc801a.zaage.it/'


{
  "lan_station_list": [
    {
      "hostname": "--",
      "mac_addr": "XX:XX:XX:XX:XX:XX",
      "mac_bind_flag": "3",
      "ip_addr": "192.168.0.1",
      "connect_time": "72405"
    },
    {
      "hostname": "--",
      "mac_addr": "XX:XX:XX:XX:XX:XX",
      "mac_bind_flag": "3",
      "ip_addr": "10.21.174.92",
      "connect_time": "72404"
    }
  ]
}

Cellular Information

Following queries return essential network parameters related to the cellular and 5G connectivity, such as signal strength, band configurations, and other network-related information.


curl 'http://zte-mc801a.zaage.it/goform/goform_get_cmd_process?isTest=false&cmd=network_type,
rssi,
lte_rssi,
rscp,
lte_rsrp,
Z5g_snr,
Z5g_rsrp,
ZCELLINFO_band,
Z5g_dlEarfcn,
lte_ca_pcell_arfcn,
lte_ca_pcell_band,
lte_ca_scell_band,
lte_ca_pcell_bandwidth,
lte_ca_scell_info,
lte_ca_scell_bandwidth,
wan_lte_ca,
lte_pci,
Z5g_CELL_ID,
Z5g_SINR,
cell_id,
wan_lte_ca,
lte_ca_pcell_band,
lte_ca_pcell_bandwidth,
lte_ca_scell_band,
lte_ca_scell_bandwidth,
lte_ca_pcell_arfcn,
lte_ca_scell_arfcn,
lte_multi_ca_scell_info,
wan_active_band,
nr5g_pci,
nr5g_action_band,
nr5g_cell_id,
lte_snr,
ecio,
wan_active_channel,
nr5g_action_channel&multi_data=1' -H 'Referer: http://zte-mc801a.zaage.it/'


{
  "network_type": "ENDC",
  "rssi": "",
  "lte_rssi": "-72",
  "rscp": "",
  "lte_rsrp": "-105",
  "Z5g_snr": "",
  "Z5g_rsrp": "-101",
  "ZCELLINFO_band": "",
  "Z5g_dlEarfcn": "",
  "lte_ca_pcell_arfcn": "",
  "lte_ca_pcell_band": "3",
  "lte_ca_scell_band": "7",
  "lte_ca_pcell_bandwidth": "20.0",
  "lte_ca_scell_info": "",
  "lte_ca_scell_bandwidth": "20.0",
  "wan_lte_ca": "ca_deactivated",
  "lte_pci": "186",
  "Z5g_CELL_ID": "",
  "Z5g_SINR": "21.0",
  "cell_id": "1a51b02",
  "lte_ca_scell_arfcn": "",
  "lte_multi_ca_scell_info": "1,170,1,7,3050,20.0",
  "wan_active_band": "LTE BAND 3",
  "nr5g_pci": "ca",
  "nr5g_action_band": "n1",
  "nr5g_cell_id": "",
  "lte_snr": "11.0",
  "ecio": "",
  "wan_active_channel": "1300",
  "nr5g_action_channel": "431070"
}


curl 'http://zte-mc801a.zaage.it/goform/goform_get_cmd_process?isTest=false&cmd=modem_main_state,
puknumber,
pinnumber,
opms_wan_mode,
psw_fail_num_str,
login_lock_time,
SleepStatusForSingleChipCpe,
pin_save_flag&multi_data=1' -H 'Referer: http://zte-mc801a.zaage.it/'


{
  "modem_main_state": "modem_init_complete",
  "puknumber": "10",
  "pinnumber": "3",
  "opms_wan_mode": "LTE_BRIDGE",
  "psw_fail_num_str": "5",
  "login_lock_time": "-1",
  "SleepStatusForSingleChipCpe": "2",
  "pin_save_flag": ""
}

SMS Information

This gives an overview of the SMS storage capacity and the number of SMS messages stored in both the device memory and the SIM card.


curl 'http://zte-mc801a.zaage.it/goform/goform_get_cmd_process?isTest=false&cmd=sms_capacity_info' -H 'Referer: http://zte-mc801a.zaage.it/'


{
  "sms_nv_total": "100",
  "sms_sim_total": "20",
  "sms_nv_rev_total": "0",
  "sms_nv_send_total": "0",
  "sms_nv_draftbox_total": "0",
  "sms_sim_rev_total": "0",
  "sms_sim_send_total": "0",
  "sms_sim_draftbox_total": "0"
}

Firmware Upgrade Status

Shows if the device can contact the ZTE update servers for unattended firmware upgrades.


curl 'http://zte-mc801a.zaage.it/goform/goform_get_cmd_process?isTest=false&cmd=upgrade_result' -H 'Referer: http://zte-mc801a.zaage.it/'


{
  "upgrade_result": "error"
}

Firmware Version

Returns current firmware version and web interface language.


curl 'http://zte-mc801a.zaage.it/goform/goform_get_cmd_process?isTest=false&cmd=Language,cr_version,wa_inner_version&multi_data=1' -H 'Referer: http://zte-mc801a.zaage.it/'


{
  "Language": "en",
  "cr_version": "",
  "wa_inner_version": "MC801AV1.0.0B16"
}

Prometheus Exporter⌗

The Prometheus Exporter and Grafana Dashboard are available here: ZTE MC801A HyperBox 5G Prometeus Exporter [git.zaage.it]

Grafana Dashboard⌗

When I designed the dashboard, I clearly focused on device metrics and cellular information. Since I have disabled WiFi mode and use the modem in bridge mode, I have used all the data from this category only as a filler.

ZTE MC801A HyperBox 5G Dashboard

If you are a bit familiar with ENDC and LTE-NSA, radio cells and basic RF principles, the dashboard definitely makes sense to monitor the connection quality and link performance. I hope the dashboard is somewhat self-explanatory.

Have fun! 😁