Taming the China Mobile ZTE ZXHN F613EV9 ONT: Precise-Timing Reset, Forcing Out TR069, and Switching to Bridge Mode
Many people on China Mobile home broadband have been issued this particular ONT, the ZTE ZXHN F613EV9 (common hardware version V9.0, firmware version V2.2.0P1T11). When you ask the installer to switch it to bridge mode, they often poke at their maintenance PDA for ages and then point at the greyed-out, uneditable WAN mode and tell you: "This new batch is locked down — bridge mode is not possible."
In reality the hardware is not the limitation; the carrier’s firmware is. It blocks you from taking the existing PPP routing connection and simply switching the dropdown to Bridge. The real method is to delete the original PPP routing connection and create a new Bridge connection with the same VLAN ID.
The bigger headache is the super-admin password and the backend protection mechanism. Without resetting the ONT you cannot get in with the default super password at all; and even if you do obtain it and switch to bridge mode, as long as the backend keeps TR069, a cloud push from the central office will quietly revert you to routing mode within a few days, and may even rotate the super password dynamically.
Today I will walk through the complete, pitfall-free procedure for this ONT, from resetting at the right moment to obtain the default super password, through injecting code in the console to delete TR069, to creating the bridge connection and making Telnet persistent.
This article applies only to devices you own or are authorised to manage. Menu names and default parameters may differ by region, batch, and firmware — always defer to the actual device.
1. Why can’t the installer change it?
In the default admin panel, the connection mode (WAN Type) under the broadband connection settings is locked and greyed out by the carrier; you cannot simply switch the dropdown from routing to bridging.
Plenty of people take the lazy route and spend a few yuan on second-hand marketplaces for a so-called "one-time super password". But as long as the ONT is connected to the central office and the remote provisioning channel remains open, the office will push the configuration again after a while and force your bridge connection back to routing.
To fix this once and for all, there are just two essentials: reset to obtain the default super password, and go into the backend and kill off TR069 remote management entirely.
2. Before you start: back up the key network parameters
Because the ONT will be fully reset to factory defaults, the original configuration will be wiped.Before touching anything, log in to the admin panel with the ordinary account printed on the bottom of the ONT and screenshot or note down the following key parameters:
① LOID / PASSWORD / SN
Go to [Network] -> [Remote Management] and copy down the LOID, PASSWORD and SN fields exactly as shown. In some regions (Zhejiang Mobile, for instance) the LOID and PASSWORD are identical, and authentication relies mainly on the PASSWORD.
② VLAN ID
Go to [Status] -> [Network Side Information] and look at the number after the current internet connection name. That number is your internet service VLAN ID (for example the 4031 in the screenshot — it differs by region and by central office, so you must record your own!).
③ PPPoE broadband account and password
After switching to bridge mode you will dial from your own router, so the account and password must be ready in advance. The password field in the ONT admin panel is masked with encrypted asterisks; if there is no sticker on the ONT casing, it is best to reset the password through the official China Mobile app beforehand.
3. The key trick: reset the ONT by watching the indicator light
Many people hold Reset for tens of seconds and find the ONT simply will not reset. That is because this model requires you to hit exactly the right moment in its boot sequence:
- Completely unplug the pigtail fibre (the optical cable) so the central office cannot push a configuration reset the instant you reset.
- Unplug the ONT power adapter to cut power.
- Plug the power back in and power it up — do not press Reset at this point, and keep your eyes fixed on the optical signal indicator on the front panel.
- The instant you see the optical signal light turn red, immediately press and hold the Reset pinhole with a SIM ejector tool and do not let go!
- Keep holding for roughly ten-odd seconds, until you observe every indicator on the ONT light up at the same time, then release the reset button.
Once it finishes rebooting, the ONT has genuinely been restored to the China Mobile factory-default super account:
- Super account:
CMCCAdmin - Super password:
aDm8H%MdA
Extremely important warning: after the reset is complete, you absolutely must not plug the fibre back in! As soon as the fibre is connected and the ONT reaches the central office, the super password will be changed to a random one by the office within seconds!
4. Super-admin configuration and blocking the central office for good
Connect your computer to the ONT LAN port with an Ethernet cable, open 192.168.1.1 in a browser, and log in with the default super account and password above.
① Delete TR069 by injecting code in the Console
Open the broadband connection list and select the management channel for TR069. The "Delete" button in the interface is greyed out, and even removing the disabled attribute via Inspect Element still leaves it unclickable — because the frontend page has stripped away the bound pageDel function logic.
Press F12 to open the browser developer tools, switch to the Console, and paste in the following JS code to re-attach the delete event:
// Re-bind the delete event and trigger TR069 removal
(() => {
const f = document.getElementById('mainFrame');
const w = f?.contentWindow, d = w?.document;
const s = d?.getElementById('Frm_WANCName0');
const b = d?.getElementById('Btn_Delete');
const name = s?.options[s.selectedIndex]?.text ?? '';
if (!/TR[-_]?069/i.test(name)) throw new Error(`Stopping: the selected connection is not TR-069: ${name}`);
if (!b || typeof w.pageDel !== 'function' || typeof w.addEvent !== 'function')
throw new Error('The page structure differs; aborting the operation');
b.disabled = false;
w.addEvent(b, 'click', w.pageDel);
if (typeof w.handleRemoveClickEvent === 'function')
w.addEvent(b, 'click', w.handleRemoveClickEvent);
console.log(`Delete button restored: ${name}`);
})();
Once the code has run, click the "Delete" button in the interface again and the TR069 channel will be torn out completely!
② Disable forced provisioning and the RMS server (belt and braces)
To eliminate any remaining risk, it is worth checking these two settings:
Go to [Management] -> [Device Management] -> [Forced Provisioning] and confirm that forced provisioning is switched off.
Go to [Network] -> [Remote Management] -> [RMS Server] and untick "Enable". If that page is greyed out and cannot be changed, run a single line of code in the Console to unlock it:
document.getElementById('mainFrame').contentWindow.EnableALL?.();
Once unlocked, untick "Enable" and click Save.
③ Check and restore the PASSWORD
Go to [Network] -> [Remote Management] and check whether PASSWORD, LOID and SN are still present. If the reset wiped them, manually enter the values you noted earlier and save.
5. Create the new Bridge connection
With the basic obstacles cleared, go to [Network] -> [Broadband Settings] -> [Internet Connection] and click to create a new connection:
- IP protocol version: IPv4/v6
- Mode: Bridge
- Port binding: I suggest selecting LAN1 through LAN4 (after bridging, the remaining ports on the ONT will not split traffic automatically by default, so ticking them all lets you plug the router into whichever port you like)
- VLAN mode: Rewrite (tag)
- VLAN ID: enter the value you backed up earlier (4031 in this example — do not copy it)
One small tip: there is no need to deliberately disable the ONT’s local DHCP service. Leaving it on lets you plug a cable in and reach the ONT admin panel directly at any later point, without configuring a static IP by hand.
6. Plug the fibre back in and verify the status
Only after saving all the configuration should you plug the fibre back in.
① Network test
After the fibre is back in, there is usually no need to wait for any registration. Enter the broadband account and password in your own router and dial with PPPoE — it will normally connect and obtain an IP within seconds.
If you manually triggered registration, it is entirely normal for the progress to stall at 30%. That is because we deleted the TR069 remote management channel, so the central office cannot push configuration; it does not affect the underlying physical optical path.
② Remote status re-check
Go to the status page and confirm:
- Interaction established: shows not connected
- Service configuration provisioning status: shows not provisioned
As long as these two remain in a disconnected state, the carrier cloud can no longer force-reset your bridge configuration or your super password.
7. Advanced: enable and make Telnet persistent
Enabling Telnet on a ZTE ONT is relatively straightforward thanks to the open-source zteOnu tool, which opens it up directly:
./zteOnu -i 192.168.1.1 --port 80 -u CMCCAdmin -p 'aDm8H%MdA' --iface eth1 --telnet
Once the command finishes executing, Telnet access is permanently available, making future configuration backups and deep parameter changes far more comfortable.
Reference and repost source: related technical materials.