Thursday, March 23, 2017

Locking custom LTE bands on ZTE MF286

My ZTE MF286 is running DNA firmware version B04. It's somewhat limited in LTE band selection, but that can easily be worked around with curl.
First of all authenticate to device using web browser. Otherwise these commands will return failure. You want to see {"result":"success"} message.

# 2100MHz (B1) / 1800MHz (B3) / 2600MHz (B7) / 800MHz (B20) / 700MHz (B28) - this is default setting
curl -s -H "Referer: http://192.168.1.1/index.html" "http://192.168.1.1/goform/goform_set_cmd_process?isTest=false&goformId=SET_NETWORK_BAND_LOCK&lte_band_lock=0x8080045"

# 1800MHz (B3) only
curl -s -H "Referer: http://192.168.1.1/index.html" "http://192.168.1.1/goform/goform_set_cmd_process?isTest=false&goformId=SET_NETWORK_BAND_LOCK&lte_band_lock=0x04"

# 2600MHz (B7) only
curl -s -H "Referer: http://192.168.1.1/index.html" "http://192.168.1.1/goform/goform_set_cmd_process?isTest=false&goformId=SET_NETWORK_BAND_LOCK&lte_band_lock=0x40"

# 800MHz (B20) only
curl -s -H "Referer: http://192.168.1.1/index.html" "http://192.168.1.1/goform/goform_set_cmd_process?isTest=false&goformId=SET_NETWORK_BAND_LOCK&lte_band_lock=0x80000"

# 700MHz (B28) only
curl -s -H "Referer: http://192.168.1.1/index.html" "http://192.168.1.1/goform/goform_set_cmd_process?isTest=false&goformId=SET_NETWORK_BAND_LOCK&lte_band_lock=0x8000000"


# 1800MHz (B3) / 2600MHz (B7) only
curl -s -H "Referer: http://192.168.1.1/index.html" "http://192.168.1.1/goform/goform_set_cmd_process?isTest=false&goformId=SET_NETWORK_BAND_LOCK&lte_band_lock=0x45"

# 800MHz (B20) / 2600MHz (B7) only
curl -s -H "Referer: http://192.168.1.1/index.html" "http://192.168.1.1/goform/goform_set_cmd_process?isTest=false&goformId=SET_NETWORK_BAND_LOCK&lte_band_lock=0x80040"

# 800MHz (B20) / 1800MHz (B3) only
curl -s -H "Referer: http://192.168.1.1/index.html" "http://192.168.1.1/goform/goform_set_cmd_process?isTest=false&goformId=SET_NETWORK_BAND_LOCK&lte_band_lock=0x80004"

# 700MHz (B28) / 800MHz (B20) only
curl -s -H "Referer: http://192.168.1.1/index.html" "http://192.168.1.1/goform/goform_set_cmd_process?isTest=false&goformId=SET_NETWORK_BAND_LOCK&lte_band_lock=0x8080000"

20 comments:

  1. Hi. Do you know how to lock that modem at LTE_A?

    ReplyDelete
    Replies
    1. Yeah, I would like to know that too. Does e.g. B20 and B3 only setting allows to aggregate them?

      Delete
  2. Sadly these don't work anymore with B09 firmware.

    ReplyDelete
  3. Greetings!

    Do you maybe have command for 2100MHz only?

    Thank you!

    ReplyDelete
  4. I need these for ZTE mf 382 router please! Text me,i will pay!

    skype: johnysmithenz
    email: aleksandarhakler1992@gmail.com

    ReplyDelete
  5. Anyone who knows how to band lock the mf286? Doesn't seem to work with the latest firmware?

    ReplyDelete
  6. Do you have any idea how to change default port for mf286 from 80 to eg. 8080 ?

    ReplyDelete
  7. Deplorably the between net is partially answerable for this. Like the 'Power' the between net likewise has a Dark side, and lately it's anything but a developing number locales offering data on Lock picking and Locksmiths Tools available to be purchased. slotenservice-rotterdam010

    ReplyDelete
  8. I’ve recently started a site, the information you offer on this site has helped me greatly. Thanks for all of your time & work.
    Also vist my page: 출장안마
    (jk)

    Also visit my webpage -

    Hey there, You’ve done an incredible job. I’ll definitely digg it
    and for my part suggest to my friends. I am confident they will be benefited from this site.|

    Also visit my page:

    ReplyDelete
  9. 0X02 LTE BAND2
    0X08 LTE BAND4
    0X10 LTE BAND5
    0X0800 LTE BAND12
    0X10000 LTE BAND 17
    0X01 LTE BAND1
    0X04 LTE BAND3
    0X40 LTE BAND7
    0X0080 LTE BAND8
    0X80000 LTE BAND 20
    0X01 LTE BAND1
    0X04 LTE BAND3
    0X10 LTE BAND5
    0X40 LTE BAND7
    0X0080 LTE BAND8
    0X0400 LTE BAND11
    0X20000 LTE BAND18
    0X40000 LTE BAND19
    0X100000 LTE BAND 21

    ReplyDelete
  10. 0X0800000 WCDMA BAND2
    0X4000000 WCDMA BAND5
    0X80 GSM1800
    0x300 GSM900
    0X400000 WCDMA BAND1
    0X2000000000000 WCDMA BAND8
    0X400000 WCDMA BAND1
    0X4000000 WCDMA BAND5
    0X8000000 WCDMA BAND6
    0X2000000000000 WCDMA BAND8
    0X1000000000000000 WCDMA BAND19

    ReplyDelete
  11. # 2100MHz (B) only
    curl -s -H "Referer: http://192.168.1.1/index.html" "http://192.168.1.1/goform/goform_set_cmd_process?isTest=false&goformId=SET_NETWORK_BAND_LOCK&lte_band_lock=0x01"

    ReplyDelete
  12. Example of calculation
    0X8080045 =[0X01(LTE BAND1)+0X04(LTE BAND3)+0X40(LTE BAND7)+0X80000(LTE BAND20)+0X8000000 (LTE BAND28)

    # 2100MHz (B1) / 1800MHz (B3) / 2600MHz (B7) / 800MHz (B20) / 700MHz (B28)

    0X-----01 +
    0X-----04 +
    0X-----40 +
    0X--80000 +
    0x8000000 +
    =
    0x8080045

    ReplyDelete
  13. # 2100MHz (B1) / 1800MHz (B3) / 2600MHz (B7) / 800MHz (B20)

    curl -s -H "Referer: http://192.168.0.1/index.html" "http://192.168.0.1/goform/goform_set_cmd_process?isTest=false&goformId=SET_NETWORK_BAND_LOCK&lte_band_lock=0x80045"

    ReplyDelete
  14. TO send USSD request in ZTE modem try this

    http://192.168.0.1/index.html#ussd

    ReplyDelete
  15. Hi, I find reading this article a joy. It is extremely helpful and interesting and very much looking forward to reading more of your work.. silicone wristbands

    ReplyDelete
  16. hi, is this working with ztemf286r?

    ReplyDelete
  17. This is such a great resource that you are providing and you give it away for free. I love seeing blog that understand the value of providing a quality resource for free. silicone wristbands to buy

    ReplyDelete
  18. how to authenticate to device using web browser

    ReplyDelete

Got something to say?!