Taming a China Unicom Huawei HS8346X6-C ONT: Default Super Password, Full Bridge Mode, and Fixing the Registration 99 Redirect

Risk warning: This article applies only to equipment you own and are authorised to manage. Resetting an ONT, deleting remote management connections, or changing its configuration can cause loss of connectivity, failed registration, voided warranty, or lost settings. Before you start, record the LOID, VLAN ID, and broadband account credentials in full, and have a recovery plan ready.

Many people on a China Unicom gigabit plan end up with this ONT: the Huawei HS8346X6-C (hardware version 2C9D.A, firmware V5R022C00S200). Bridge mode had been set up by the installer at activation — then a careless click on LOID re-authentication in the admin panel refreshed the configuration and threw it straight back into router mode.

A search online turns up mostly guides for the standard HS8346X6 (without the -C suffix), and following them directly simply does not work. After a full round of trial and error, I worked out a complete reset-and-bridge path that needs no case opening and no complicated packet capture. This article walks through every pitfall and every step, so anyone hitting the same problem can skip the dead ends.

1. What can you do in normal user mode?

Before committing to a reset for super-admin access, I took a quick look at what the normal user panel allows and where it stops. The HS8346X6-C is no slouch on paper (AX3000 Wi-Fi 6 + GPON + four gigabit ports), and if you use it purely as a household main router, a direct 5GHz Wi-Fi connection really can sail past a gigabit.

Pain points and limits

• Wi-Fi channel width is locked: the normal panel simply does not expose channel or channel-width options. The 5GHz band often drops back to 80MHz on its own and cannot saturate a gigabit link, while 2.4GHz is pinned to 20MHz outright.

  

• The public IPv4 firewall is half-baked: the panel does let you turn the IPv4 firewall off, but there is no DMZ or port forwarding entry, so a public IP is hard to put to full use. Turning the IPv4 firewall off does, however, silently open the ONT's Telnet port.

  

• The IPv6 firewall is locked down (front-end bypass): the IPv6 firewall switch is on by default and greyed out (disabled). The validation here is front-end only, though: press F12 to inspect the element, delete the disabled attribute from the relevant input and button, untick "Enable IPv6 firewall to control forwarded packets", and click Apply — it turns off successfully.

  Note: do not expect the same F12 trick to change route/bridge mode in the broadband configuration screen. That save request is strictly validated on the back end, so the change will not stick.

  

2. Why does the usual Telnet password lookup fail?

Many guides for the version without -C say that after disabling the firewall in the normal panel, you connect over Telnet (default credentials root / adminHW), run display current-configuration, and search for CUAdmin to dump the password in plain text.

On the custom -C models, however, Huawei changed the configuration file: in the exported config, the CUAdmin field's Password attribute is simply empty.

Since the password cannot be read out, the most direct route is this:physically reset the ONT and force it back to the factory default super password.

3. Core preparation before you reset (back up first!)

Once the ONT is reset, the configuration delivered by the vendor is wiped completely.Before you start, you must log into the normal panel, take screenshots, and record two pieces of critical data:

1. LOID (logical ID): go to [Authentication & Registration] -> [LOID Authentication] and copy the entire string out verbatim. Without it, the ONT cannot reach the carrier's office after the reset.
2. VLAN ID and PPPoE account: go to [Network] -> [Broadband Configuration] and check the VLAN ID of the current Internet connection (12 in this example — it varies by carrier office, so record your own). Confirm the PPPoE credentials in advance; if you have forgotten the password, reset it ahead of time in China Unicom's official app.

4. Reset pitfalls and how the super password was finally obtained

The reset looks simple, but a few extremely subtle pitfalls decide whether you get kicked out the moment you log in.

First reset attempt: the panel kicks you out

• Procedure: unplug the fibre, power on the ONT, and when the optical signal LED blinks, hold Reset for a dozen seconds until all LEDs light, then go dark leaving only the power LED.
• Symptom: after the reboot the panel did show the registration page, and the super password was restored to the standard Unicom CUAdmin. But — the moment you log in and try to change any setting or delete the TR069 remote management connection, the panel force-logs you straight back out to the sign-in page. Plug the fibre back in and the super password is immediately changed again by the carrier side.

Second attempt: what actually worked

Unplug the fibre and reset again — this time two things were handled differently:

1. Hold Reset longer: press the reset pinhole for more than 30 seconds to make sure the internal cache and temporary state are fully erased.
2. The order of operations is critical:
   • Again, boot with the fibre unplugged, and log into the panel with the default super credentials CUAdmin;
   • First thing, go to the security page and turn the IPv6 firewall off;
   • Then immediately switch to the broadband connection page, select the remote management channel containing TR069, and click delete directly. This time there was no forced logout at all, and the deletion succeeded in one go!

Once TR069 is gone, the Unicom carrier side can no longer push a configuration down over the network to overwrite yours.

5. Creating the bridged WAN configuration

With TR069 deleted, plug the fibre back in and manually enter the LOID you backed up. Because there is no remote provisioning any more, registration progress stalling at 30% is normal and does not affect network traffic at all.

Next, go to [Network] -> [Broadband Configuration] and create or edit a bridged connection:

• Encapsulation: PPPoE
• Protocol type: IPv4/IPv6
• WAN type: Bridge WAN
• Enable VLAN: tick it
• VLAN ID: enter the value you recorded earlier (12, for example — never copy someone else's)
• Binding port: tick the LAN port you want to connect your main router to (LAN1, for instance)

After saving, connect the router's WAN port to the matching LAN port on the ONT, enter the PPPoE credentials in the router's admin panel, and dial up. You should then receive independent public IPv4 and IPv6 prefixes.

6. Advanced troubleshooting: registration 99 and DNS hijack pop-ups after deleting TR069

Many people finish the bridge setup and then find that, intermittently or when connected to the ONT's own hotspot, web pages are forcibly redirected to the ONT registration page (DNS hijacking), with the status bar showing:

• Registration status: 99 (no authentication result information)
• Configuration result: 99 (no provisioning result information)

This happens because deleting TR069 leaves the ONT judging the service order as not fully delivered, which triggers the unregistered-LAN interception.

Eliminating the hijack completely

1. Export (download) the current system configuration file hw_ctree.xml from the ONT admin panel.
2. Use a Huawei ONT configuration decryption tool (such as the Huawei configuration encryption/decryption tool) to decrypt the file into plain-text XML.
3. Open it in a text editor and search and replace the following key values:
   • Change Status="99" to Status="0" (0 means authentication succeeded)
   • Change Result="99" to Result="1" (1 means provisioning succeeded)
4. Re-encrypt and repackage the configuration file, import it back through the panel, and wait for the ONT to reboot.

Once the reboot finishes, every service status in the ONT's system information turns to "success", and the annoying forced pop-ups and DNS pollution stop for good.

Closing notes

Menu names, default policies, and parameters can differ between provinces, production batches, and firmware versions. The VLAN 12 in this article is only an example — always go by the data you backed up from your own line. If the ONT cannot register after a reset, restore the original configuration first or contact your carrier's installation and maintenance staff.

Reference and repost source: ZhiChao: Taming a China Unicom Huawei HS8346X6-C ONT.