What type of encryption has been used to Zyxel VMG8924-B10A config file?

[flightwatch]

Italians, English, and Croats have access to CFE, where they either read the admin / supervisor password or upload non-branded firmware:

https://www.hwupgrade.it/forum/showthread.php?t=2891309

http://forum.pcekspert.com/showthread.php?p=2761531

https://www.boards.ie/vbulletin//showthread.php?t=2057302483

Unfortunately, my bootloader is password protected:

https://paste.in/E9cN86

The only thing I managed to rip was the data I posted above. This is not a firmware dump. This is probably just a save of settings. I was able to read it after entering the address:

IP_router/backupsettings.conf

IP_router/configuration-backupsettings.conf

IP_router/pages/tabFW/configuration-backupsettings.conf

IP_router/dumpcfgdynamic.cmd

IP_router/dumpmdm.cmd

IP_router/dumpcfgdynamic.conf

IP_router/password.cmd

What unencrypted firmware are you writing about? You mean a file that someone ripped with a programmer directly from the bone, or a file from another router with an unblocked dump memory command? Even if I get such a file, it will not have the same version of the software as I have and will come from another operator.

[phroyt]

Have you looked at OpenWRT project?

Maybe the old sources could help you:
https://openwrt.org/toh/zyxel/zyxel_vmg7947-b40a_o2_homebox_6641_de01v2f

[h8er]

Originally Posted by flightwatch

What unencrypted firmware are you writing about? You mean a file that someone ripped with a programmer directly from the bone, or a file from another router with an unblocked dump memory command? Even if I get such a file, it will not have the same version of the software as I have and will come from another operator.

I think he means that you have to physically desolder the firmware rom memory from your router pcb and then dump the content with a programmer (if you need it take a look at XGecu TL866II programmers on aliexpress, they are quite cheap).