Case study

zte-cpe-sms: reconstructing ZTE CPE SMS API access

zte-cpe-sms reconstructs access to the internal SMS API of ZTE MC889 and related 5G CPE devices. Its protocol notes describe login hashing, an RSA session-key exchange, a token that must be recalculated after key exchange, and UCS-2 message encoding; Node.js CLI and web clients use those findings to read and send SMS.

Targets: Protocol
Category: Independent reconstruction cases
Relationship: Independent reconstruction project
Sources reviewed: 2026-11-06
Evidence class: C2 code & docs, no demo or download

Stars: 0
Last commit: 2026-10-28
Language: JavaScript
License (GitHub): MIT

GitHub data as of 2026-11-10

Copy as Markdown View JSON Cite

Evidence

Observed: Code and documentation observed; no download method or demo found.
Checked: 2026-11-08

How evidence classes are assigned

Requirements & limits

Prerequisites: Node.js 18 or newer and the router's web UI password are required.
Scope: The documented protocol findings were checked on MC889 firmware BD_ATMC889V1.0.0B19.
Limits: The web UI has no login and is intended for a trusted LAN.
License: MIT License.

Cite

BibTeX

@misc{zte-cpe-sms-case,
  title = {{zte-cpe-sms: reconstructing ZTE CPE SMS API access}},
  howpublished = {\url{https://github.com/FratteFlorian/zte-cpe-sms}},
  url = {https://github.com/FratteFlorian/zte-cpe-sms},
  urldate = {2026-11-06},
  note = {Awesome REA entry: \url{https://awesomerea.org/resources/zte-cpe-sms-case/}}
}

Plain text

zte-cpe-sms: reconstructing ZTE CPE SMS API access. https://github.com/FratteFlorian/zte-cpe-sms (accessed 2026-11-06). Awesome REA entry: https://awesomerea.org/resources/zte-cpe-sms-case/

Useful? Star Awesome REA on GitHub2.4k

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

docs/PROTOCOL.md GitHub · FratteFlorian/zte-cpe-sms · Revision fcc32d4
README.md GitHub · FratteFlorian/zte-cpe-sms · Revision fcc32d4