What type of encryption has been used to Zyxel VMG8924-B10A config file?

[flightwatch]

Originally Posted by phroyt

Have you looked at OpenWRT project?

Maybe the old sources could help you:
https://openwrt.org/toh/zyxel/zyxel_vmg7947-b40a_o2_homebox_6641_de01v2f

Unfortunately, I just use this router, but it is owned by the operator. I cannot upload an alternative software.

Originally Posted by h8er

I think he means that you have to physically desolder the firmware rom memory from your router pcb and then dump the content with a programmer (if you need it take a look at XGecu TL866II programmers on aliexpress, they are quite cheap).

I would prefer to do this with a program, as I'm only leasing the router. At the same time, if nothing else works, I will have to make it the way you suggest.

Originally Posted by atom0s

Here is the entire /etc/default.cfg file with the given section you wanted the info of. (Assuming you want it from the stock firmware image.)

https://paste.ofcode.org/WJSJepUufKz8xrRAfGJsdQ

Is this data deciphered from my router or is it just exemplary data?

In the file you provided, the enrypted password is shown: WV35vVCAM9iQu78h7YaFGYiarcHW7AMbNE5phQAAADk=

but I guess it isn't Base64, as the decoder shows something like this: Y]щЅPЂ3Шђ»ї!н†…€љ­БЦм4Ni…

Originally Posted by atom0s

In regards to your config paste though, would need more info on the exact version of the firmware you are using since the one you linked to does not seem to create a similar output to what you dumped. So the scripts used to create the encrypted backup are probably different between versions.

I can't link the exact firmware, as it's not publically available. The router works in Polish Orange.
As I use user account, I'm not able to read the firmware version.
When I'm connecting to serial port, something like this appears: CFE version 1.0.38-112.118 for BCM963268 (32bit,SP,BE)
Build Date: 08/08/2017 (jason@DaJiaBu)
Copyright (C) 2000-2011 Broadcom Corporation.

NAND ECC BCH-8, page size 0x800 bytes, spare size used 64 bytes
NAND flash device: name Toshiba TC58NVG0S3HTAI0, id 0x98f1 block 128KB size 131072KB
Correctable ECC Error detected: addr=0x0000b200, intrCtrl=0x00000090, accessCtrl=0xF7881010
External switch id = 53125
Chip ID: BCM63168D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 134217728 bytes (128MB)
Boot Address: 0xb8000000