# zte-cpe-sms: reconstructing ZTE CPE SMS API access

> zte-cpe-sms reconstructs access to the internal SMS API of ZTE MC889 and related 5G CPE devices. Its protocol notes describe login hashing, an RSA session-key exchange, a token that must be recalculated after key exchange, and UCS-2 message encoding; Node.js CLI and web clients use those findings to read and send SMS.

- Type: Case study
- Targets: Protocol
- Category: Independent reconstruction cases
- Relationship: Independent reconstruction project
- Sources reviewed: 2026-11-06
- Added to the catalog: 2026-11-08
- Original resource: <https://github.com/FratteFlorian/zte-cpe-sms>
- Primary source: <https://github.com/FratteFlorian/zte-cpe-sms/blob/fcc32d45d8ca3fee4400e5850180de4c33675fad/docs/PROTOCOL.md>
- Catalog page: <https://awesomerea.org/resources/zte-cpe-sms-case/>
- Record JSON: <https://awesomerea.org/resources/zte-cpe-sms-case/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/zte-cpe-sms-case/index.md)

## Requirements & limits

- **Prerequisites:** Node.js 18 or newer and the router's web UI password are required.
- **Scope:** The documented protocol findings were checked on MC889 firmware BD_ATMC889V1.0.0B19.
- **Limits:** The web UI has no login and is intended for a trusted LAN.
- **License:** MIT License.

## Primary sources

1. <https://github.com/FratteFlorian/zte-cpe-sms/blob/fcc32d45d8ca3fee4400e5850180de4c33675fad/docs/PROTOCOL.md>
2. <https://github.com/FratteFlorian/zte-cpe-sms/blob/fcc32d45d8ca3fee4400e5850180de4c33675fad/README.md>

## More in Protocols

- [gs5-rgb: Creative Sound Blaster GS5 lighting protocol](https://awesomerea.org/resources/gs5-rgb-case/index.md) · Case study
- [Telly Remote: reconstructing TYRC-1 remote control over Bluetooth and infrared](https://awesomerea.org/resources/telly-remote-case/index.md) · Case study
- [Wave Buds: a client for the JBL Wave Buds control protocol](https://awesomerea.org/resources/wave-buds-case/index.md) · Case study
- [manifold-558s-ble: reconstructing testo 558s measurement messages](https://awesomerea.org/resources/manifold-558s-ble-case/index.md) · Case study
- [attackshark-x11prov2: decoding the X11 PRO V2 mouse configuration protocol](https://awesomerea.org/resources/attackshark-x11prov2-case/index.md) · Case study
- [AULA Hub: reconstructing the AULA F99 Pro keyboard protocol](https://awesomerea.org/resources/aula-hub-f99-protocol-case/index.md) · Case study

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.