Prometheus Exporter for ZTE MC801A HyperBox 5G

updated by 11 min read #networking #reverse engineering

Contents

Introduction#

This post documents the HTTP API of the ZTE MC801A HyperBox 5G router, including some undocumented endpoints, and introduces a Prometheus exporter and Grafana dashboard for it. It is for anyone who wants to monitor this router, or a related ZTE model, from their own monitoring stack.

Because of my fondness for network technology, and because I wanted to learn more about the open-source firewall OPNsense, I planned a multi-WAN setup. The fallback uplink is a ZTE MC801A HyperBox 5G [ztedevices.com, archived] router.

SpecificationDescription
NetworkNSA&SA (5G: n41/78/79/1/28) / (4G: B1/3/5/8/28/34/39/40)
MIMO5G+LTE: (sub6G DL: 4MIMO) / (4G DL: 8layers) / (LTE: 4MIMO on 5CA)
Broadband (MHz)200M
PlatformSDX55+QCA6391
ModulationDL 256QAM, UL 256QAM
LTE+5G EN-DC peak rate4.6Gbps
Dimensions182 x 124 x 70mm
Wi-FiWi-Fi 6, 2.4G&5G dual band, 2x2 MIMO, 1.775 Gbit/s, 32 users
Antenna3.5GHz band max gain up to 9dBi (optional)
InterfaceLed: power, Wi-Fi, network, signal x3

For those who are interested in internal photos: ZTE MC801A 5G CPE Internal Photos [fccid.io]

This post is not about the firewall configuration, but about the ZTE router itself. To my surprise, nobody had written a monitoring exporter for this device series yet.

I already run a Prometheus monitoring stack with Grafana as the front end, so the 5G router needed its own exporter. I also designed a new Grafana dashboard from scratch, because I couldn’t find a comparable one to reuse.

The following sections describe the ZTE API and then introduce the exporter and the dashboard.

Login procedure#

The web front end of the ZTE MC801A only supports unencrypted HTTP, so the developers added a small challenge–response scheme to the login. Because only one login session can be active, this is “more secure” than sending the password in clear text. Still, the whole construct is adventurous and outdated for a company that sells enterprise network equipment and smartphones.

The relevant code is in the JavaScript file service.js and, as so often, slightly obfuscated.

javascript Obfuscated Login Procedure
function de() {
  function e(e, t) {
    var r = hr({
      nv: 'LD'
    }).LD;
    return {
      isTest: gi,
      goformId: 'LOGIN',
      password: '2' == n.WEB_ATTR_IF_SUPPORT_SHA256 ? paswordAlgorithmsCookie(paswordAlgorithmsCookie(e.password) + r) : '1' == n.WEB_ATTR_IF_SUPPORT_SHA256 ? paswordAlgorithmsCookie(Base64.encode(e.password)) : Base64.encode(e.password)
    }
  }
}

The code is readable as it is, but I wanted to experiment with GPT-4 and had it rewrite the snippet in a more readable form.

javascript Login Procedure
function loginFormBuilder() {
  // Inner function to build login form data
  function buildLoginForm(userData, config) {
    // Fetch the LD token using a function or object named 'hr'
    var ldToken = hr({ nv: 'LD' }).LD;

    // Prepare the login form data
    return {
      isTest: config.isTest,
      goformId: 'LOGIN',
      password: '2' == config.sha256Support
        ? applyPasswordAlgorithm(applyPasswordAlgorithm(userData.password) + ldToken)
        : '1' == config.sha256Support
          ? applyPasswordAlgorithm(Base64.encode(userData.password))
          : Base64.encode(userData.password)
    };
  }

  // Return the inner function for external use
  return buildLoginForm;
}

So the login is done in the following steps:

  1. The router sends a time-limited LD token to the client.
  2. The client computes sha256_encode(sha256_encode(ZTE_PASSWORD) + ld_token).
  3. The router answers with a result code and a session cookie.

If SHA-256 support is switched off (WEB_ATTR_IF_SUPPORT_SHA256 is not 1 or 2), there is a fallback: the password is simply Base64-encoded and the LD token isn’t used at all. Really?

API endpoints#

Under the hood, the router runs a full Android operating system. Firmware images circulate on the Internet completely unencrypted, in line with the login procedure. At least everyone can audit their device… Whoopsie!

The firmware images helped me take the API apart and dig out hidden parameters.

Strictly speaking, there is only one endpoint, /goform/goform_get_cmd_process. It accepts a GET request with one or more parameters in cmd. Not all parameters can be queried at the same time, though, because the back end, which is partly written in Bash, has internal limits.

I haven’t tried all combinations, so some parameters appear in more than one of the sample queries below.

Wi-Fi access point status

This query returns all configured wireless access points. Each access point is an object with attributes such as SSID, authentication mode, encryption type and password.

Oh yes! It returns the Wi-Fi password, Base64-encoded…

bash HTTP Request
curl 'http://zte-mc801a.zaage.it/goform/goform_get_cmd_process?isTest=false&cmd=queryAccessPointInfo' -H 'Referer: http://zte-mc801a.zaage.it/'
json Endpoint Result
{
  "ResponseList": [
    {
      "ChipIndex": "0",
      "AccessPointIndex": "0",
      "AccessPointSwitchStatus": "1",
      "SSID": "ZTE_XXXXXX",
      "ApMaxStationNumber": "30",
      "ApIsolate": "0",
      "AuthMode": "WPA2PSK",
      "EncrypType": "CCMP",
      "Password": "xxxxxxxxxxxxxx",
      "QrImageUrl": "/etc_rw/ztembb/wlan/qrcode/wifi_chip1_ssid1_ssid_qrcode.png",
      "ApBroadcastDisabled": "0",
      "CurrentStationNumber": "0",
      "CountryCode": "DE",
      "WirelessMode": "7",
      "Channel": "0",
      "BandWidth": "2",
      "Band": "b",
      "SSIDPMF": "",
      "mbss_isolate_webui": "",
      "mbss_isolate_webui_5G": "",
      "GuestSSIDActiveTime": ""
    },
    {
      "ChipIndex": "0",
      "AccessPointIndex": "1",
      "AccessPointSwitchStatus": "0",
      "SSID": "ZTE_XXXXXX_Guest",
      "ApMaxStationNumber": "30",
      "ApIsolate": "0",
      "AuthMode": "WPA2PSK",
      "EncrypType": "CCMP",
      "Password": "xxxxxxxxxxxxx",
      "QrImageUrl": "/etc_rw/ztembb/wlan/qrcode/wifi_chip1_ssid2_ssid_qrcode.png",
      "ApBroadcastDisabled": "0",
      "CurrentStationNumber": "0",
      "CountryCode": "DE",
      "WirelessMode": "7",
      "Channel": "0",
      "BandWidth": "2",
      "Band": "b",
      "SSIDPMF": "",
      "mbss_isolate_webui": "",
      "mbss_isolate_webui_5G": "",
      "GuestSSIDActiveTime": ""
    },
    {
      "ChipIndex": "0",
      "AccessPointIndex": "2",
      "AccessPointSwitchStatus": "",
      "SSID": "",
      "ApMaxStationNumber": "",
      "ApIsolate": "",
      "AuthMode": "",
      "EncrypType": "",
      "Password": "",
      "QrImageUrl": "",
      "ApBroadcastDisabled": "",
      "CurrentStationNumber": "",
      "CountryCode": "",
      "WirelessMode": "",
      "Channel": "",
      "BandWidth": "",
      "Band": "",
      "SSIDPMF": "",
      "mbss_isolate_webui": "",
      "mbss_isolate_webui_5G": "",
      "GuestSSIDActiveTime": ""
    },
    {
      "ChipIndex": "0",
      "AccessPointIndex": "3",
      "AccessPointSwitchStatus": "",
      "SSID": "",
      "ApMaxStationNumber": "",
      "ApIsolate": "",
      "AuthMode": "",
      "EncrypType": "",
      "Password": "",
      "QrImageUrl": "",
      "ApBroadcastDisabled": "",
      "CurrentStationNumber": "",
      "CountryCode": "",
      "WirelessMode": "",
      "Channel": "",
      "BandWidth": "",
      "Band": "",
      "SSIDPMF": "",
      "mbss_isolate_webui": "",
      "mbss_isolate_webui_5G": "",
      "GuestSSIDActiveTime": ""
    },
    {
      "ChipIndex": "1",
      "AccessPointIndex": "0",
      "AccessPointSwitchStatus": "1",
      "SSID": "ZTE_XXXXXX_5G",
      "ApMaxStationNumber": "30",
      "ApIsolate": "0",
      "AuthMode": "WPA2PSK",
      "EncrypType": "CCMP",
      "Password": "xxxxxxxxxxxxxxx",
      "QrImageUrl": "/etc_rw/ztembb/wlan/qrcode/wifi_chip2_ssid1_ssid_qrcode.png",
      "ApBroadcastDisabled": "0",
      "CurrentStationNumber": "0",
      "CountryCode": "DE",
      "WirelessMode": "8",
      "Channel": "0",
      "BandWidth": "4",
      "Band": "a",
      "SSIDPMF": "",
      "mbss_isolate_webui": "",
      "mbss_isolate_webui_5G": "",
      "GuestSSIDActiveTime": ""
    },
    {
      "ChipIndex": "1",
      "AccessPointIndex": "1",
      "AccessPointSwitchStatus": "0",
      "SSID": "ZTE_5GCPE_",
      "ApMaxStationNumber": "30",
      "ApIsolate": "0",
      "AuthMode": "WPA2PSK",
      "EncrypType": "CCMP",
      "Password": "xxxxxxxxxxxxxxxxx",
      "QrImageUrl": "",
      "ApBroadcastDisabled": "0",
      "CurrentStationNumber": "0",
      "CountryCode": "DE",
      "WirelessMode": "8",
      "Channel": "0",
      "BandWidth": "4",
      "Band": "a",
      "SSIDPMF": "",
      "mbss_isolate_webui": "",
      "mbss_isolate_webui_5G": "",
      "GuestSSIDActiveTime": ""
    },
    {
      "ChipIndex": "1",
      "AccessPointIndex": "2",
      "AccessPointSwitchStatus": "",
      "SSID": "",
      "ApMaxStationNumber": "",
      "ApIsolate": "",
      "AuthMode": "",
      "EncrypType": "",
      "Password": "",
      "QrImageUrl": "",
      "ApBroadcastDisabled": "",
      "CurrentStationNumber": "",
      "CountryCode": "",
      "WirelessMode": "",
      "Channel": "",
      "BandWidth": "",
      "Band": "",
      "SSIDPMF": "",
      "mbss_isolate_webui": "",
      "mbss_isolate_webui_5G": "",
      "GuestSSIDActiveTime": ""
    },
    {
      "ChipIndex": "1",
      "AccessPointIndex": "3",
      "AccessPointSwitchStatus": "",
      "SSID": "",
      "ApMaxStationNumber": "",
      "ApIsolate": "",
      "AuthMode": "",
      "EncrypType": "",
      "Password": "",
      "QrImageUrl": "",
      "ApBroadcastDisabled": "",
      "CurrentStationNumber": "",
      "CountryCode": "",
      "WirelessMode": "",
      "Channel": "",
      "BandWidth": "",
      "Band": "",
      "SSIDPMF": "",
      "mbss_isolate_webui": "",
      "mbss_isolate_webui_5G": "",
      "GuestSSIDActiveTime": ""
    }
  ]
}

Temperature and power

This query returns temperature and power readings for the 5G modem, the power amplifier and the system board.

bash HTTP Request
curl 'http://zte-mc801a.zaage.it/goform/goform_get_cmd_process?isTest=false&cmd=wifi_chip_temp,
therm_pa_level,
therm_pa_frl_level,
therm_tj_level,
pm_sensor_pa1,
pm_sensor_mdm,
pm_modem_5g&multi_data=1' -H 'Referer: http://zte-mc801a.zaage.it/'
json Endpoint Result
{
  "wifi_chip_temp": "",
  "therm_pa_level": "0",
  "therm_pa_frl_level": "0",
  "therm_tj_level": "0",
  "pm_sensor_pa1": "-40",
  "pm_sensor_mdm": "63",
  "pm_modem_5g": "60"
}

Device information

One of the larger queries, it collects data from three categories:

  • Wi-Fi settings: SSID, authentication mode and so on, and the maximum number of connected devices.
  • Network information: network type, WAN and LAN IP addresses and IPv6 configuration.
  • Device information: hardware version, firmware versions and IMEI.
bash HTTP Request
curl 'http://zte-mc801a.zaage.it/goform/goform_get_cmd_process?isTest=false&cmd=wifi_onoff_state,
guest_switch,
wifi_chip1_ssid2_max_access_num,
m_SSID2,
wifi_chip2_ssid2_max_access_num,
wifi_chip1_ssid1_wifi_coverage,
apn_interface_version,
m_ssid_enable,
imei,
network_type,
rssi,
rscp,
lte_rsrp,
imsi,
sim_imsi,
cr_version,
wa_version,
hardware_version,
web_version,
wa_inner_version,
wifi_chip1_ssid1_max_access_num,
wifi_chip1_ssid1_ssid,
wifi_chip1_ssid1_auth_mode,
wifi_chip1_ssid1_password_encode,
wifi_chip2_ssid1_ssid,
wifi_chip2_ssid1_auth_mode,
m_HideSSID,
wifi_chip2_ssid1_password_encode,
wifi_chip2_ssid1_max_access_num,
lan_ipaddr,
lan_ipaddr,
wlan_mac_address,
msisdn,
LocalDomain,
wan_ipaddr,
static_wan_ipaddr,
ipv6_wan_ipaddr,
ipv6_pdp_type,
ipv6_pdp_type_ui,
pdp_type,
pdp_type_ui,
opms_wan_mode,
opms_wan_auto_mode,
ppp_status,
Z5g_snr,
Z5g_rsrp,
wan_lte_ca,
lte_ca_pcell_band,
lte_ca_pcell_bandwidth,
lte_ca_scell_band,
lte_ca_scell_bandwidth,
lte_ca_pcell_arfcn,
lte_ca_scell_arfcn,
lte_multi_ca_scell_info,
wan_active_band,
wifi_onoff_state,
guest_switch,
wifi_chip1_ssid2_max_access_num,
wifi_chip2_ssid2_max_access_num,
wifi_chip1_ssid1_wifi_coverage,
wifi_chip1_ssid1_max_access_num,
wifi_chip1_ssid1_ssid,
wifi_chip1_ssid1_auth_mode,
wifi_chip1_ssid1_password_encode,
wifi_chip2_ssid1_ssid,
wifi_chip2_ssid1_auth_mode,
wifi_chip2_ssid1_password_encode,
wifi_chip2_ssid1_max_access_num,
wifi_chip1_ssid2_ssid,
wifi_chip2_ssid2_ssid,
wifi_chip1_ssid1_switch_onoff,
wifi_chip2_ssid1_switch_onoff,
wifi_chip1_ssid2_switch_onoff,
wifi_chip2_ssid2_switch_onoff,
Z5g_SINR,
station_ip_addr,
build_version_time,
imei_sv,
multi_pdns_wan_ipaddr_2,
multi_pdns_ipv6_wan_ipaddr_2&multi_data=1' -H 'Referer: http://zte-mc801a.zaage.it/'
json Endpoint Result
{
  "wifi_onoff_state": "0",
  "guest_switch": "",
  "wifi_chip1_ssid2_max_access_num": "30",
  "m_SSID2": "",
  "wifi_chip2_ssid2_max_access_num": "30",
  "wifi_chip1_ssid1_wifi_coverage": "short_mode",
  "apn_interface_version": "2",
  "m_ssid_enable": "",
  "imei": "00000000000000000",
  "network_type": "ENDC",
  "rssi": "",
  "rscp": "",
  "lte_rsrp": "-105",
  "imsi": "",
  "sim_imsi": "0000000000000000000",
  "cr_version": "",
  "wa_version": "",
  "hardware_version": "MC801AHW-1.0.0",
  "web_version": "WEB_DETMOMC801AV1.0.0B14",
  "wa_inner_version": "MC801AV1.0.0B16",
  "wifi_chip1_ssid1_max_access_num": "30",
  "wifi_chip1_ssid1_ssid": "ZTE_XXXXXXX",
  "wifi_chip1_ssid1_auth_mode": "WPA2PSK",
  "wifi_chip1_ssid1_password_encode": "xxxxxxxxxxxx",
  "wifi_chip2_ssid1_ssid": "ZTE_XXXXXXX_5G",
  "wifi_chip2_ssid1_auth_mode": "WPA2PSK",
  "m_HideSSID": "",
  "wifi_chip2_ssid1_password_encode": "xxxxxxxxxxxx",
  "wifi_chip2_ssid1_max_access_num": "30",
  "lan_ipaddr": "192.168.0.5",
  "wlan_mac_address": "xx:xx:xx:xx:xx:xx",
  "msisdn": "49151xxxxxxx",
  "LocalDomain": "",
  "wan_ipaddr": "10.21.174.92",
  "static_wan_ipaddr": "",
  "ipv6_wan_ipaddr": "2a01:0598:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx",
  "ipv6_pdp_type": "IPv4v6",
  "ipv6_pdp_type_ui": "",
  "pdp_type": "IPv4v6",
  "pdp_type_ui": "IPv4v6",
  "opms_wan_mode": "LTE_BRIDGE",
  "opms_wan_auto_mode": "AUTO_LTE_GATEWAY",
  "ppp_status": "ipv4_ipv6_connected",
  "Z5g_snr": "",
  "Z5g_rsrp": "-96",
  "wan_lte_ca": "",
  "lte_ca_pcell_band": "",
  "lte_ca_pcell_bandwidth": "",
  "lte_ca_scell_band": "",
  "lte_ca_scell_bandwidth": "",
  "lte_ca_pcell_arfcn": "",
  "lte_ca_scell_arfcn": "",
  "lte_multi_ca_scell_info": "",
  "wan_active_band": "LTE BAND 3",
  "wifi_chip1_ssid2_ssid": "ZTE_XXXXXX_Guest",
  "wifi_chip2_ssid2_ssid": "ZTE_5GCPE_",
  "wifi_chip1_ssid1_switch_onoff": "1",
  "wifi_chip2_ssid1_switch_onoff": "1",
  "wifi_chip1_ssid2_switch_onoff": "0",
  "wifi_chip2_ssid2_switch_onoff": "0",
  "Z5g_SINR": "19.5",
  "station_ip_addr": "0",
  "build_version_time": "12/12/2022",
  "imei_sv": "F",
  "multi_pdns_wan_ipaddr_2": "",
  "multi_pdns_ipv6_wan_ipaddr_2": ""
}
bash HTTP Request
curl 'http://zte-mc801a.zaage.it/goform/goform_get_cmd_process?isTest=false&multi_data=1&cmd=wifi_sta_connection,ap_station_mode,m_ssid_enable' -H 'Referer: http://zte-mc801a.zaage.it/'
json Endpoint Response
{
  "wifi_sta_connection": "0",
  "ap_station_mode": "wifi_pref",
  "m_ssid_enable": ""
}

Network information

This query returns only network data (LAN, WAN and cellular). A second query lists all connected devices.

bash HTTP Request
curl 'http://zte-mc801a.zaage.it/goform/goform_get_cmd_process?multi_data=1&isTest=false&sms_received_flag_flag=0&sts_received_flag_flag=0&cmd=modem_main_state,
pin_status,
opms_wan_mode,
opms_wan_auto_mode,
loginfo,
new_version_state,
current_upgrade_state,
is_mandatory,
wifi_dfs_status,
battery_value,
ppp_dial_conn_fail_counter,
wifi_chip1_ssid1_auth_mode,
wifi_chip2_ssid1_auth_mode,
signalbar,
network_type,
network_provider,
ppp_status,
simcard_roam,
spn_name_data,
spn_b1_flag,
spn_b2_flag,
wifi_onoff_state,
wifi_chip1_ssid1_ssid,
wifi_chip2_ssid1_ssid,
wan_lte_ca,
monthly_tx_bytes,
monthly_rx_bytes,
pppoe_status,
dhcp_wan_status,
static_wan_status,
rmcc,
rmnc,
mdm_mcc,
mdm_mnc,
EX_SSID1,
sta_ip_status,
EX_wifi_profile,
m_ssid_enable,
RadioOff,
wifi_chip1_ssid1_access_sta_num,
wifi_chip2_ssid1_access_sta_num,
lan_ipaddr,
station_mac,
wifi_access_sta_num,
battery_charging,
battery_vol_percent,
battery_pers,
realtime_tx_bytes,
realtime_rx_bytes,
realtime_time,
realtime_tx_thrpt,
realtime_rx_thrpt,
monthly_time,
date_month,
data_volume_limit_switch,
data_volume_limit_size,
data_volume_alert_percent,
data_volume_limit_unit,
roam_setting_option,
upg_roam_switch,
ssid,
wifi_enable,
wifi_5g_enable,
check_web_conflict,
dial_mode,
privacy_read_flag,
is_night_mode,
vpn_conn_status,
wan_connect_status,
sms_received_flag,
sts_received_flag,
sms_unread_num,
wifi_chip1_ssid2_access_sta_num,
wifi_chip2_ssid2_access_sta_num' -H 'Referer: http://zte-mc801a.zaage.it/'
json Endpoint Response
{
  "modem_main_state": "modem_init_complete",
  "pin_status": "1",
  "opms_wan_mode": "LTE_BRIDGE",
  "opms_wan_auto_mode": "AUTO_LTE_GATEWAY",
  "loginfo": "ok",
  "new_version_state": "version_idle",
  "current_upgrade_state": "fota_idle",
  "is_mandatory": "",
  "wifi_dfs_status": "",
  "battery_value": "100",
  "ppp_dial_conn_fail_counter": "0",
  "wifi_chip1_ssid1_auth_mode": "WPA2PSK",
  "wifi_chip2_ssid1_auth_mode": "WPA2PSK",
  "signalbar": "4",
  "network_type": "ENDC",
  "network_provider": "Telekom.de",
  "ppp_status": "ipv4_ipv6_connected",
  "simcard_roam": "Home",
  "spn_name_data": "00000000000000000000000000000000000000000000000000",
  "spn_b1_flag": "0",
  "spn_b2_flag": "0",
  "wifi_onoff_state": "0",
  "wifi_chip1_ssid1_ssid": "ZTE_XXXXXX",
  "wifi_chip2_ssid1_ssid": "ZTE_XXXXXX_5G",
  "wan_lte_ca": "ca_deactivated",
  "monthly_tx_bytes": "2009566748",
  "monthly_rx_bytes": "53458759605",
  "pppoe_status": "ppp_disconnected",
  "dhcp_wan_status": "0",
  "static_wan_status": "",
  "rmcc": "262",
  "rmnc": "1",
  "mdm_mcc": "262",
  "mdm_mnc": "01",
  "EX_SSID1": "",
  "sta_ip_status": "disconnect",
  "EX_wifi_profile": "",
  "m_ssid_enable": "",
  "RadioOff": "0",
  "wifi_chip1_ssid1_access_sta_num": "0",
  "wifi_chip2_ssid1_access_sta_num": "0",
  "lan_ipaddr": "192.168.0.5",
  "station_mac": "",
  "wifi_access_sta_num": "0",
  "battery_charging": "0",
  "battery_vol_percent": "100",
  "battery_pers": "4",
  "realtime_tx_bytes": "429475373",
  "realtime_rx_bytes": "8320583139",
  "realtime_time": "69771",
  "realtime_tx_thrpt": "485",
  "realtime_rx_thrpt": "468",
  "monthly_time": "926656",
  "date_month": "20230801",
  "data_volume_limit_switch": "0",
  "data_volume_limit_size": "",
  "data_volume_alert_percent": "",
  "data_volume_limit_unit": "",
  "roam_setting_option": "off",
  "upg_roam_switch": "0",
  "ssid": "",
  "wifi_enable": "",
  "wifi_5g_enable": "0",
  "check_web_conflict": "ok",
  "dial_mode": "auto_dial",
  "privacy_read_flag": "1",
  "is_night_mode": "0",
  "vpn_conn_status": "disconnected",
  "wan_connect_status": "pdp_connected",
  "sms_received_flag": "",
  "sts_received_flag": "",
  "sms_unread_num": "0",
  "sms_dev_unread_num": "0",
  "sms_sim_unread_num": "0",
  "wifi_chip1_ssid2_access_sta_num": "0",
  "wifi_chip2_ssid2_access_sta_num": "0"
}
bash HTTP Request
curl 'http://zte-mc801a.zaage.it/goform/goform_get_cmd_process?isTest=false&cmd=lan_station_list' -H 'Referer: http://zte-mc801a.zaage.it/'
json Endpoint Response
{
  "lan_station_list": [
    {
      "hostname": "--",
      "mac_addr": "XX:XX:XX:XX:XX:XX",
      "mac_bind_flag": "3",
      "ip_addr": "192.168.0.1",
      "connect_time": "72405"
    },
    {
      "hostname": "--",
      "mac_addr": "XX:XX:XX:XX:XX:XX",
      "mac_bind_flag": "3",
      "ip_addr": "10.21.174.92",
      "connect_time": "72404"
    }
  ]
}

Cellular information

These queries return the cellular and 5G parameters, such as signal strength and band configuration, and the SIM PIN/PUK status.

bash HTTP Request
curl 'http://zte-mc801a.zaage.it/goform/goform_get_cmd_process?isTest=false&cmd=network_type,
rssi,
lte_rssi,
rscp,
lte_rsrp,
Z5g_snr,
Z5g_rsrp,
ZCELLINFO_band,
Z5g_dlEarfcn,
lte_ca_pcell_arfcn,
lte_ca_pcell_band,
lte_ca_scell_band,
lte_ca_pcell_bandwidth,
lte_ca_scell_info,
lte_ca_scell_bandwidth,
wan_lte_ca,
lte_pci,
Z5g_CELL_ID,
Z5g_SINR,
cell_id,
wan_lte_ca,
lte_ca_pcell_band,
lte_ca_pcell_bandwidth,
lte_ca_scell_band,
lte_ca_scell_bandwidth,
lte_ca_pcell_arfcn,
lte_ca_scell_arfcn,
lte_multi_ca_scell_info,
wan_active_band,
nr5g_pci,
nr5g_action_band,
nr5g_cell_id,
lte_snr,
ecio,
wan_active_channel,
nr5g_action_channel&multi_data=1' -H 'Referer: http://zte-mc801a.zaage.it/'
json Endpoint Response
{
  "network_type": "ENDC",
  "rssi": "",
  "lte_rssi": "-72",
  "rscp": "",
  "lte_rsrp": "-105",
  "Z5g_snr": "",
  "Z5g_rsrp": "-101",
  "ZCELLINFO_band": "",
  "Z5g_dlEarfcn": "",
  "lte_ca_pcell_arfcn": "",
  "lte_ca_pcell_band": "3",
  "lte_ca_scell_band": "7",
  "lte_ca_pcell_bandwidth": "20.0",
  "lte_ca_scell_info": "",
  "lte_ca_scell_bandwidth": "20.0",
  "wan_lte_ca": "ca_deactivated",
  "lte_pci": "xxx",
  "Z5g_CELL_ID": "",
  "Z5g_SINR": "21.0",
  "cell_id": "xxxxxxx",
  "lte_ca_scell_arfcn": "",
  "lte_multi_ca_scell_info": "1,xxx,1,7,3050,20.0",
  "wan_active_band": "LTE BAND 3",
  "nr5g_pci": "xx",
  "nr5g_action_band": "n1",
  "nr5g_cell_id": "",
  "lte_snr": "11.0",
  "ecio": "",
  "wan_active_channel": "1300",
  "nr5g_action_channel": "431070"
}
bash HTTP Request
curl 'http://zte-mc801a.zaage.it/goform/goform_get_cmd_process?isTest=false&cmd=modem_main_state,
puknumber,
pinnumber,
opms_wan_mode,
psw_fail_num_str,
login_lock_time,
SleepStatusForSingleChipCpe,
pin_save_flag&multi_data=1' -H 'Referer: http://zte-mc801a.zaage.it/'
json Endpoint Response
{
  "modem_main_state": "modem_init_complete",
  "puknumber": "10",
  "pinnumber": "3",
  "opms_wan_mode": "LTE_BRIDGE",
  "psw_fail_num_str": "5",
  "login_lock_time": "-1",
  "SleepStatusForSingleChipCpe": "2",
  "pin_save_flag": ""
}

SMS information

This shows the SMS storage capacity and the number of messages stored in the device memory and on the SIM card.

bash HTTP Request
curl 'http://zte-mc801a.zaage.it/goform/goform_get_cmd_process?isTest=false&cmd=sms_capacity_info' -H 'Referer: http://zte-mc801a.zaage.it/'
json Endpoint Response
{
  "sms_nv_total": "100",
  "sms_sim_total": "20",
  "sms_nv_rev_total": "0",
  "sms_nv_send_total": "0",
  "sms_nv_draftbox_total": "0",
  "sms_sim_rev_total": "0",
  "sms_sim_send_total": "0",
  "sms_sim_draftbox_total": "0"
}

Firmware upgrade status

This shows whether the device can reach the ZTE update servers for unattended firmware upgrades.

bash HTTP Request
curl 'http://zte-mc801a.zaage.it/goform/goform_get_cmd_process?isTest=false&cmd=upgrade_result' -H 'Referer: http://zte-mc801a.zaage.it/'
json Endpoint Response
{
  "upgrade_result": "error"
}

Firmware version

This returns the current firmware version and the language of the web interface.

bash HTTP Request
curl 'http://zte-mc801a.zaage.it/goform/goform_get_cmd_process?isTest=false&cmd=Language,cr_version,wa_inner_version&multi_data=1' -H 'Referer: http://zte-mc801a.zaage.it/'
json Endpoint Response
{
  "Language": "en",
  "cr_version": "",
  "wa_inner_version": "MC801AV1.0.0B16"
}

Prometheus exporter#

The Prometheus Exporter and Grafana Dashboard are available here: ZTE MC801A HyperBox 5G Prometheus Exporter [git.zaage.it]

Grafana dashboard#

The dashboard focuses on device metrics and cellular information. I have switched off Wi-Fi and use the router in bridge mode, so the Wi-Fi panels are only filler.

Grafana dashboard for the ZTE MC801A: LTE and 5G signal quality, WAN data rate, modem and board temperatures, and a cellular status table, with identifiers blurred
Grafana dashboard

If you know a little about EN-DC and LTE NSA, radio cells and basic RF principles, the dashboard is useful for watching connection quality and link performance. I hope it is largely self-explanatory.

Conclusion#

The MC801A has no official API, but its web interface talks to a single, fairly generous endpoint. Once logged in, the exporter can read almost everything the router knows, from signal quality to temperatures, and Prometheus and Grafana turn that into a dashboard for the fallback uplink. The login scheme and the Wi-Fi passwords in the API responses are a good reason to keep the router’s web interface away from untrusted networks.

Sources#

cd ~/projects