Vigor 2760 Firmware
Stephaine Zitzow
This firmware is only suitable for Vigor 2760 models currently/already running 3.x.x firmware versions (aka 'DrayOS/Delight'). It is not compatible or suitable for Vigor 2760 models running firmware 1.x.x.
IMPORTANT NOTE :
Firmware is normally supplied in two different styles: The ALL file will just upgrade the firmware, whereas the RST file will upgrade the firmware and wipe all settings back to factory defaults.
The resources on these pages are for users in the UK and Ireland only. If you are outside of the UK/Ireland, please contact your local supplier, the local support resource in your country or use the DrayTek International site instead
I've spent my spare time the last couple of days attempting to reverse engineer and modify the firmware of the new Vigor 2760 VDSL2 modem. It quite quickly became clear the whole system is built around OpenWRT 10.03, yet it appears they have not made their sources publicly available. I've sent an email to their support days ago now but it seems they preferred to ignore me.
The system is built around a Lantiq SoC, 500MHz mips cpu, 128MB ram and 128MB flash. And from what I gather getting custom openwrt up and running on this device should be pretty easy once I've gathered enough information. Modem code and such are of course binary blobs, that being both a good and bad thing, not being able to run it out of spec and illegal power levels, but a pity to loose tweaking abilities. I've got the rootfs amongst other extracted and access to all files but the most interesting stuff is encrypted, even the basic configuration file is lzma compressed and then salted/hashed so it's hard to extract any good information, but I'm working on it.
As someone quite new in this scene, I'm making this post in the hopes of getting some help on how to approach draytek to obtain their sources of all the GPL'd software they use. I bet it's not gonna be easy.. but if someone else has gone through a similar process I'd love to hear how it went and what steps they took (especially if it was draytek).
root access and file modifications can be done through UART as it dumps you to a root shell, but all important stuff gets reset on reboot, such as the passwd file. Although it's possible to edit init files many/most changes will not stick passed reboot. Init files writes a passwd file to a ramdisk on boot. default passwords are unsalted, hash was easy to crack as the password was just admin.
most mtd's can be read, but uboot loader (mtd0) just gives FFFFFFFFFFFFFF.....so it's not hooked up. Not sure how to get around that. Almost certain firmware images are signed so uboot would have to be modified, so no easy flash from web interface).
The device by default lets you ssh/telnet into it dropping you into their own "draysh", but there isn't much to do except what can be done in webif. I tried replacing it with /bin/sh and busybox but then it wasn't possible to login through telnet/ssh any more, connection would just close. This change actually sticked around passed a reboot.
In their "draysh" there is a command named "enable", which asks for a password. I believe with this password you'll just get dumped to a normal shell with root access (same as can be achieved with UART).
I think I found a master password in there though, salted and hashed md5crypt. Spent some hours trying to decrypt it but it's probably quite random, and quite possible unique for each device. I believe cracking this one would only allow you to use this "enable" function to gain root access without opening the box. Or perhaps some backdoor/recovery if someone lost their password and don't want to reset the device. Further more there are some tools to modify DSL behaviour and view stats that are not exposed to webif.
I'm sitting on quite a bit of default configuration files/terminal logs/mtd-dumps, filesystem dumps and such if anyone else wants to have a go at it. But I believe the only way we could have a proper openwrt support (just flashing the image from webif) is to get into and dissect their uboot (or DrayBoot, as they call it).
I'm seriously considering having a second telephone line installed with another FTTC 80/20 connection with Plusnet. Then in November when my voda 80/20 contract ends switch that vdsl line to Uno for example or whatever.
We used to use a Draytek with 2 x 80/20 FTTC and it worked very well for both load balancing and failover. Easy to set up too! I don't know personally of any other kit that works as well at the Draytek.
I purchased a DrayTek Vigor 2862 Series weekend before last, ready for when my 200 mbps Virgin Media Cable connection was available (last Tuesday). You are right! It does work very well for both load balancing and failover. I've tested it on both those fronts and I can't fault it. It works impeccably well!
When I did some research, before hand, I found that some people in the UK had purchased a non-UK Firmware version , out of the box (a grey import, non-UK version). This can be very tricky to set up from what I've seen. So, from what I can see, it must have an xxxxxxx_BT (UK) Firmware installed to even consider it.
I buy all my kit from UK distributors so haven't come across the issue of a non-UK firmware, I'm using a Vigor 2760 at present and it's been very good, so I'm a happy little bunny. Ever since I've been using them, I've only ever had one fail and that was replaced under warranty so all in all, a good buy at the price they're sold at. The Draytek site is pretty good with lots of support although you do have to register with an email address, that said, they never contact you with anything. 200Mbps makes me jealous, especially with an 80/20 backup / balance... *sigh* Have fun and enjoy!
To be honest the Virgin media 200 Mbps connection wasn't my first choice. When I did use them before, twice they had line card issues and took 3 months to fix it each time. Currently it's working perfectly though. Over wise I would of cancelled it during the 14 day period.
The last time, our neighbour lost their FTTC for over a week. This was due to my new broadband being connected to their telephone line. My ISP could see their Global4 modem when they checked the line.
So I had no broadband at all on my new line, and the neighbours modem, which was trying to connect to their existing service but had been disconnected completely, and obviously wouldn't log in to my broadband with their existing user name and password for their service.
I agree, can we have the facility to turn off these parts of HA causing these issues. That way we can still run our routers and other setups without this breaking our networks. That way we all have a choice to upgrade the router firmware it the companies are still supporting those models or turn off these settings in HA to continue using HA in an existing environment. I still believe this is the latest Matter inclusion causing this behaviour but like most people using HA, we already are using wifi, zigbee and/or zwave for devices and may not need to transition to Matter for a while, if at all.
Same issue too with Home Assistant 2023.7.1. Killing the whole network without rebooting. Turning OFF UPNP and everything it working like it should. Network router is a Draytek Vigor 2760
I have a Pi4b running Debian 11 and Home Assistant Core on Docker
But recently I have noticed that our speed is lower. We have had openreach out as we were experiencing really poor performance. Line was apparently good but I think something is not right. Our (non BT) router has been having disconnections for no apparent reason (and I have swapped it for a nother good unit of the same type but to no avail). The BT router was dropped as my kids were experiencing poor wi-fi coverage; the draytek vigor 2760 is a bit old but seems to be better in that regard.
Thanks for posting about the connection dropping, sorry you're having a few problems there. The guys are right. Can you check the quiet line test and get back to us with the results and we can take it from there.
The DrayTek Vigor 2760 series VDSL2 / ADSL2+ multi modem routers are designed for VDSL2 broadband network and can also support ADSL2/2+ fixed line. There are three models: Vigor 2760, Vigor 2760n (with IEEE 802.11n WLAN), and Vigor 2760Vn (with VoIP and IEEE 802.11n WLAN,coming soon). IPv6 support will be available as a firmware update to ensure future network and higher-speed WAN throughput, the high-definition multi-media streaming is available for home entertainment and digital learning. The embedded VPN connections allow family members to utilize ultimate broadband performance. The MAC access control, multiple-SSID, authentication management on WLAN creates a secure wireless network. The users of your connected PCs can use the Web Portal Log-in and Bulletin Board to leave notes and reminders to each other. The content security management (CSM) protects / prevents your family or home office from unwanted access to web sites.
The DrayTek Vigor2760 Series can set 4 SSID groups. In Access Control, the router may restrict wireless access to certain wireless clients only by locking their MAC address into a black or white list. The user may block wireless clients by inserting their MAC addresses into a black list, or only let them be able to connect by inserting their MAC addresses into a white list.
64591212e2