T-Mobile Wi-Fi CellSpot Dual-Band AC1900 Gigabit Router (Certified Pre-Owned) Expired

Plug it into a 240V and smell it.

if you are a T-mobile user, you can call and say service is bad at your location. they may provide you the same router for free as long you remain a user >1 year. You get to keep it after 1 year.

TL;DR: After a struggle, I got this thing flashed to stock Asus firmware & bootloader, BUT it's more involved than it used to be. Here are my instructions (and experience and notes):

I ordered this router from a SD that was posted right before this one which is now my 2nd of this model. My first one was when these really went on fire last year -- I wrote up a tight set of instructions including screen-capture videos of how to do it, but the process was a good bit simpler then (esp for mac users).

When I got this one, I tried using my previous instructions but immediately hit a wall trying to put the unit into rescue-mode: something about rescue-mode/CFE-mode is definitely different from the previous hardware revision. (I'm pretty sure it's a hardware change because even after putting the exact same CFE and firmware on it, the difference remained.) Trivia for those who care: the CFE is the bootloader and "firmware environment" of the router... kind of a lower-level firmware FOR the firmware: https://en.wikipedia.org/wiki/Com...nvironment.
Anyway, it turns out that you now need to hold down the reset button for almost the entire flashing process AND execute the firmware-upload as fast as possible, as there appears to be a timeout that will kick the router out of rescue-mode, even mid-upload. (I'm pretty sure these are the only new "tricks" to know, so I have cut out a bunch of details from the below instructions that seemed important a few days ago -- they're moved to the notes at the end of this post, if anyone cares.)

INSTRUCTIONS FOR DOWNGRADING FIRMWARE FROM v3181 (FOR ENABLING SSH)

Step 0 - Pre-requisites & Downloads you'll want
*Manually configure your IPv4 network settings for a static IP of 192.168.29.8, mask of 255.255.255.0, and gateway of 192.168.29.1
*Directly connect your computer via ethernet cable to port1 on the back of the router

*Obtain the "TM-AC1900_3.0.0.4_376_1703-g0ffdbba.trx" (downgrade-firmware) file
*Unzip/save that file to your desktop

*Obtain a large paperclip
*Bend that paperclip in such a way that it will pinch around the side of the router and hold down the reset button for you
*Make sure you know the sound/feel of the click/unclick of the reset button

Step 1 - Prepare for miniCFE/rescue modePower-off the unit. Even though it's off, start continuously pinging the router (windows command prompt: "ping -t 192.168.29.1" ... mac terminal: "ping 192.168.29.1") because we'll need to know the instant it's available. Then open a browser tab and type in "http://192.168.29.1" BUT don't yet hit enter. Arrange your windows so you can see when the pings start succeeding.

Step 2 - Enter miniCFE/rescue mode and flash older tmobile firmwareAttach your paperclip buddy to the router so that it is firmly holding in the reset button. When you're confident it's holding, power-on the router, and start watching the ping activity. As soon as the pings start returning successfully, hit enter on your browser tab to bring up the miniCFE webpage. Immediately select your v1703 firmware file and click send. If you're using Chrome, the bottom-left corner of the window should show an upload status percentage. Watch it like a hawk.

When it hits 10%, disconnect your paperclip buddy. (I don't know this is necessary, but it's what I did.) When it hits 100% you should see the success-page I have attached to this post: the URL has been redirected to "192.168.29.1/f2.htm" and the content of the page reads: "Receive file size=16949294 / Upload completed. System is going to reboot. Please wait a few moments."

Give it several minutes to reboot and come back up.

Step 3 - Enable SSH, FINALLYBrowse to 192.168.29.1, and enter the admin/password credentials if necessary. (If you land at the setup-wizard page, click the button near the top to skip the setup wizard.) On the left sidebar, click "Administration", then on the tabs near the top, click "System". Midway down the page, under the "SSH Daemon" section, click "Yes" for "SSH Enable" then click the Apply button at the bottom of the page. Give it a few seconds to save.

Step 4 - for now, follow other guides starting from the CFE stuff

I'll copy-in the rest of the instructions from my previous post later, but for now:
We have downgraded the crappy tmobile firmware to an older MORE FUNCTIONAL one (yay!)
But we still need to replace the crappy tmobile-locked CFE bootloader on the router (boo!)
After we've done that, we can optionally update the router's firmware to whatever you want, or just leave it with the older tmo firmware which I wouldn't recommend.
Instructions for doing these things can be found in my older post, starting at step #3 --> https://slickdeals.net/f/9330575-asus-tm-ac1900-wireless-ac1900-dual-band-gigabit-router-59-free-shipping?p=94195560#post94195560

Nerdy notes and extra instructions that are probably unnecessary for anyone to read, but I'm including them just in case:

__Preface that used to be above the instructions:__
Last year time, wiping all traces of the tmobile garbage was extremely easy because the latest available firmware at that time had SSH available in the settings, which is no longer the case.
Yesterday and this morning I spent probably a combined 5 hours fighting this thing and researching other people's experiences. My problem (and I suspect the problem of many others, moving forward) was three-fold:

- The firmware 'Administration' settings no longer lists SSH, as mentioned above
- The previous "tricks" to enable SSH and/or telnet (by "fixing" the html via chrome's developer tools) also no longer work.
--- I think? The commented-out and css-hidden options all still exist, but my router refused both types of connections.
- The process to force the unit into rescue mode/recovery mode/miniCFE seems to be dramatically different than it was before
--- the router would respond to pinging but never present the CFE page.

But ultimately I did have success!! Though a lot of swearing happened, first. After scouring through many forum posts, I ended up doing several additional things that I didn't have to do last year... I'm not sure if all of them were necessary, but I got nowhere until I started getting desperate and combined things I'd been reading: - reset NVRAM
- set the router to AP-mode instead of router-mode
- hold the reset button for (ALMOST) THE ENTIRE TIME (...not just 10-10-10, not just 30-30-30, and not just "for a long time"!)
- "race" to upload the the downgrade-firmware AFAP (...because there appeared to be a timeout in play)
__Instructions I cut out from my original procedure:__
- Old Step 1 - Reset the NVRAM >> Power-off the unit using the push-button (as opposed to unplugging). Press and hold the WPS button, then power-on the unit while still holding the WPS button. Continue holding the WPS button until the power led starts to blink a few times -- at which point you can release the WPS button: This clears the NVRAM and it will reboot.
- Old Step 2 - Set the router to AP-mode >> Browse to 192.168.29.1, and enter the admin/password credentials if necessary. (If you land at the setup-wizard page, click the button near the top to skip the setup wizard.) On the left sidebar, click "Administration", then on the tabs near the top, click "Operation mode" if it's not already there. Click the button for "Access Point(AP) mode", then Save/apply the setting and allow at least a minute for the router to reboot itself.