Accessing the command line interface of the Ericsson W25

The first step if you want more from your Ericsson W25 is to gain access to its command line interface. The command line interface (CLI in the future) can be accessed over the network either by telnet or ssh protocol. Telnet is available only from within your local network, and for accessing it you can use the telnet command built into Windows: telnet
The ssh access is available both from the internal network and from the internet and you should use an ssh client like PuTTY to access it.

There are two user names available for the CLI: root and operator. You can find their default password in the document about SW upgrade on
Once you have logged in, you find yourself in a linux environment. Linux commands like ls, pwd, mount etc. will work.

There are two specific commands for the router: cf and st.

The cf command is used to set and retrieve the parameters of the router. When called without parameters it gives a help about the available commands. The parameters of the Ericsson W25 are organized into a tree structure, and with the cf command you can interrogate or set any node on the tree. For example if you would like to change the IP address of the router, you can do that with the following command: cf set ip.lan.address Here athe ip.lan.address defines the note on the tree. The command cf show, lists all nodes with their values.

The st command displays different statistics. It has the following options: usb, lan, wan, wlan, nat, natverbose, wan-stats, tel, pm and system. One of the most interesting is the wan-stat which provides reception statistics for the HSDPA modem, so you can check if the coverage is good enough at your place.

One important note, before you continue to use your W25, that the same way as you could figure out the default password, anyone else can do it, and if you do not change it, practically anyone from the internet can log into your router. So log on to the web interface with the user name root and operator and change their password in the top right side of the general tab to something with is not the standard. If you are more advanced, you can do this with the cf command as well, but you have to figure out the right node in the parameter tree yourself.

In the next post I plan to write some sentences about the hardware of the Ericsson W25.


Anonymous said…
Good words.
Infernova said…
I have an Ericsson W25 that is locked by the service provider, will I be able to load the firmware? Also it seems is down, is there another link I can get the firmware at? Good tutorial Thanks
Lacó said…
Hi Infernova!

You can download the firmware from here:

I am not sure if you can load the firmware, nor that it doesn't harm your router, but on your own risk you may give a try. After upgrading, make a full reset of the unit, by holding down the reset button on the device after turning on for about 60 seconds, then the default passwords will be applied.

In the W25 forum, see the link in the right side of my blog, you can download the latest administrator manual, it contains the operator and root password for the unit.
Infernova said…
Thanks Mr Laco, I went ahead and did it but I think something went wrong and the reset won't work, I am sending it back to the shop. Thanks for the prompt reply, appreciate it.
Infernova said…
Hi Laco,

I did that and I seem to have bricked my router. I tried bringing it back to the "authorized" guys and they just laughed at me. It seem that I downgraded and now the wui does not work anymore. It still sort of works but I am no longer able to reset.
I read on your blog that you found a way to get to the redboot using ip without going the serial port route. I was wondering if you have anymore details on how to go about doing it? I read on there seems to be a few more guys that are in my situation.
Lacó said…
Hi Infernova!

I am sorry for your bricked router :-(

Before getting very deep into it, try to connect the router to your computer directly and run a newtork monitor (e.g. WireShark) on that line, to see which IP address is it using for redboot (it should check the availability of that address right after powering on). During the normal boot process it first assigns an ip for the boot loader, and then when linux starts up, then it assigns again an ip address for that.

Then I have been using a python program, which was doing ping requests to that address, to determine when redboot was started up and then it connected using telnet and issued the ^C command. As far as I remember after that it disconnected, but I was able to connect with telnet and redboot still waited for me. I do not have this program anymore, I have lost it with some machine changes.

Then the first thing I did was to change the redboot default time out to 10 seconds, so now even without the special program I have time to enter to redboot.

I think that when you get to the redboot promt you should try to boot with both version of the firmware, may be you still have the original version working.
Infernova said…
Thanks again Laco, I am going to try this, my current ip for the router once its boot up is, do you think the redboot will stay in the say domain as in 192.168.0.X or will it be some kind of factory default like 192.168.Y.X. I am just wondering how wireshark will be able to locate other ips that it might not be able to see. I will go ahead and run it anyways and report back here.
Infernova said…
So far, I am not able to get the ip address for the redboot and I believe that my option now is to go the serial port route. It is difficult as there is very little documentation.
Lacó said…
You should try before you give up. For my W25 that is the default for redboot and hopefully this was not customised in your unit.

If you try continous ping to that address during a restart then you should get a respone.

Regarding the serial interface, I did not do that with this router but I did that for a different one and it is very important that you use the voltage level changing circuit to increase the 3,3V or 5V output to the RS232 level. I had this at home and as far as I remember it uses 232MAX chips.
Somene has posted a comment in my blog about where the serial pins are.

Popular posts from this blog

MPR-L8 (HAME MPR-A1) firmware update and firmware images