ZTE MF920V 4G router

How to hack your ZTE 4G router to connect more than 10 devices

This document outlines how to allow connecting more than 10 devices to your ZTE 4G router. By default, a ZTE MF920V 4G router allows only for 10 devices (computers, tablets, phones) to connect to it simultaneously at any given point in time.

Disclaimer: If you choose to follow this guide, you do so at your own risk. I am not responsible for any actions you choose to undertake. The below works for me, it might not work for you, and it may cause some unexpected/unintended results for you. As always, proceed with caution and certainly don’t attempt to perform this action on a network you cannot afford to get downtime on. Making changes on any router usually requires some type of restart, so all devices on the network may see their connection interrupted at some point during this article.

The below has so far only been tested on a ZTE MF920V 4G router, but I’d say it’s safe to assume it could work for similar ZTE 4G routers as well.

More visually, here’s what we’re trying to achieve (on our WLAN, 192.168.0.1 is the router’s IP address):

At the end of this short article, you’ll be able to connect more than the factory-default 10 devices to your ZTE 4G router.

Steps how to connect more than 10 devices to your router at once

  • Download and install Postman | The Collaboration Platform for API Development onto your computer.
  • While Postman is downloading, figure out what is your ZTE router’s IP address and password. In this example case, the IP was 192.168.0.1. If you don’t know the password, try ‘admin‘ (without the quotes).
  • Connect to your ZTE router via a browser, preferably Chrome or Edge (for the sake of ease of following this article, so that the screenshots here match what you see on your screen).

Enter the IP address of your ZTE router into the address bar. You should see the following appear in your browser’s address bar: http://192.168.0.1/index.html#login.

Having successfully logged in, press F12 in your browser to open the development environment, and then navigate to ‘WLAN settings’ on the ZTE router’s user interface.

Meanwhile, make sure the ‘Network’ tab is the active tab in your browser’s development environment.

Although our goal is to go beyond the maximum selectable amount of 10 simultaneous devices, for now we select “10” as the value under “Max Station Number” in “Wi-Fi Settings”. It’s important not to modify anything else on this screen. DO NOT delete or modify your SSID, security mode, password, and the likes.

Click “Apply” after setting max. station number to 10.

Affirm the “All connected Wi-Fi devices will need to reconnect. Do you want to continue?” pop-up with the “Yes” button. You should not experience any serious disruption, however some (if not all) devices may disconnect briefly.

While the router is applying the ‘new’ settings, look for the network log item entitled ‘goform_set_cmd_process‘ that does not have any URL parameters behind it. There’s only one:

Right click the log item entitled ‘goform_set_cmd_process‘, follow through to the ‘Copy’ menu, then click ‘Copy as cURL (bash)’.

Now some very important information is copied to your memory. It’s therefor vital in the meantime not to copy-paste anything new to clipboard (in general).

Since our first step was to “Download and install Postman | The Collaboration Platform for API Development onto your computer.”, it is now time to open Postman.

Click the ‘Import‘ button inside Postman.

In the popup that appears next, select the ‘Raw text‘ tab.

Now, paste in the text that we copied from our Chrome/Edge browser F12 developer tools a couple steps earlier.

You should now see a text that looks very similar to: (do NOT copy-paste the text from this article, stick to your own in-memory text!)

curl 'http://192.168.0.1/goform/goform_set_cmd_process' \
  -H 'Connection: keep-alive' \
  -H 'Accept: application/json, text/javascript, */*; q=0.01' \
  -H 'X-Requested-With: XMLHttpRequest' \
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36 Edg/87.0.664.75' \
  -H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' \
  -H 'Origin: http://192.168.0.1' \
  -H 'Referer: http://192.168.0.1/index.html' \
  -H 'Accept-Language: en-US,en;q=0.9,nl;q=0.8,fr;q=0.7,ro;q=0.6,sl;q=0.5' \
  --data-raw 'goformId=SET_WIFI_SSID1_SETTINGS&isTest=false&ssid=XXXXXXX&broadcastSsidEnabled=0&MAX_Access_num=10&security_mode=XXXXXX&cipher=1&NoForwarding=0&security_shared_mode=1&passphrase=XXXXX\
  --compressed \
  --insecure

Before clicking ‘Continue’, in the pasted text, change “MAX_Access_num=10” into “MAX_Access_num=20“. Do not change anything else.

That is the part of the command telling your ZTE router to increase the maximum number of access points beyond the limit enforced by ZTE’s default user interface (10) to 20 (in this case).

You can try experimenting with a larger number, but for me, 20 will do, as there’s probably a reason ZTE set 10 as the default “maximum”. The small 4G router probably cannot handle many more clients under circumstances in which it gets hit with heavy network traffic.

In the end, we end up with something like: (do NOT copy-paste the text from this article, stick to your own in-memory text!)

curl 'http://192.168.0.1/goform/goform_set_cmd_process' \
  -H 'Connection: keep-alive' \
  -H 'Accept: application/json, text/javascript, */*; q=0.01' \
  -H 'X-Requested-With: XMLHttpRequest' \
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36 Edg/87.0.664.75' \
  -H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' \
  -H 'Origin: http://192.168.0.1' \
  -H 'Referer: http://192.168.0.1/index.html' \
  -H 'Accept-Language: en-US,en;q=0.9,nl;q=0.8,fr;q=0.7,ro;q=0.6,sl;q=0.5' \
  --data-raw 'goformId=SET_WIFI_SSID1_SETTINGS&isTest=false&ssid=XXXXXXX&broadcastSsidEnabled=0&MAX_Access_num=20&security_mode=XXXXXX&cipher=1&NoForwarding=0&security_shared_mode=1&passphrase=XXXXX\
  --compressed \
  --insecure

Again, it’s important not to change anything else (in this article, we have censored our own network data, hence the XXXXXXX’s).

Next, click the ‘Continue‘ button.

Then, click ‘Import‘.

Finally, click ‘Send‘.

This will send the same command to the router as the browser did earlier, except that we have ‘upgraded’ the ZTE router to its intrinsic capacity of more than 10 simultaneous network clients (laptops, pc’s, tablets, phones…). We have now sent a command to the router to allow up to 20 devices to connect at once, much like as if we would have selected ’20’ from the dropdown box in one of the earlier screenshots – instead of ’10’.

The operation was successful if the router returns a status code of 200 OK, as shown below.

The ultimate test, of course, is to connect more than 10 devices to the WiFi, and to verify that via the default router UI:

Looking good. We are now able to connect more than 10 devices at the same time to our ZTE router.

Good luck, and enjoy! 🙂

7 thoughts on “How to hack your ZTE 4G router to connect more than 10 devices”

  1. Nice tutorial, appreciate it a lot.
    I tried it on my own router and with the tutorial it was straight forward.
    Unfortunately, although I get the Status: 200 OK the response of the router is {“result”:”failure”} even if I don’t change the command I copied with the dev tool in any way. If the command is send with the router webpage the response is of course {“result”:”success”}.

    Do you might have any ideas what could be wrong?

    Thanks

    1. Hi Willi, I did the above on a ZTE MF920V. What’s your ZTE router model? Perhaps the above procedure does not quite work like this for your model. For now, you could try a router reset (only if you feel comfortable doing that, of course), and to try these steps again… Also, you could try a number smaller than 20 (e.g. 15). Thanks for the kind words! Hannes.

  2. Hey, nice how-to! I have a problem and maybe you would be so kind and help me? :/ It’s a different model but the webgui looks like the same. I have to restart my router every day, because the provider kicks off all customers at night. After kicking the CA-feature isn’t available anymore…
    I don’t get the login via curl :/ The password seems to be salted… Can you give it a try? 😉 My plan is to login via curl after that change the reboot time every day by a running linux host. Weird, but the only solution :/
    Maybe sending ‘*’ as reboot day would do it every day?
    thx so far!

  3. Hi Hannes, I have to ask you if you would be that kind and help me. I have a different model but the webgui looks like the same (at all). My provider kicks all his customers at midnight. So only rebooting the router helps. The webgui only supports a restart once a weekday, so I want to script like that: login via curl, set reboot time for next day. I don’t get the login via curl, the password hash seems to be salted. do you have an idea or interested in? 😉 thx in advance!
    so long

    1. Hi Fox. I’ve not needed to do what you had to do. Hence I can only suggest how I’d go about it: using the browser’s Developer Tools (via F12), copy the auth/login request, which then can be used to every day do a new auth/login request via curl. Then, retain the token from the response message, and use that token to authenticate your daily reboot request. That way, you probably needn’t care about salted hashes since you’d be authenticated each time. Hope it helps, best of luck.

  4. Hi ,
    Really nice article.
    I have MF79U connected to Raspberry Pi. Everything OK.
    SSID are setup to ‘ztessid01’. My question is that , how to make Pi get this info by programming?

    I used ‘iwlist’ , it is ok if there is only one ssid around. But problem is there some SSID around.

    Do you know how to use goform_set_cmd_process or something like this to get a setting information ?

    Regards

Leave a Reply to Willi Cancel Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.