Zyxel PMG3000-D20B firmware image files

Zyxel PMG3000-D20B firmware image files.md

Zyxel PMG3000-D20B firmware image files

The firmware of this GPON ONT SFP module can be updated using the web interface (Management | Update Software):

The web interface only accepts image files with a special header. These can be created by adding the header to a flash dump.

Firmware collection

.img unmodified mtd2 / mtd3 flash dump
.upf with header (can be installed using the web interface)

V1.00 is based on OpenWrt 12.09. Deutsche Telekom (Germany) seems to stick with this branch.

V1.00(ABVJ.0)b3s (2020-12-23)

V1.00(ABVJ.0)b3v (2021-05-08)

V1.00(ABVJ.1)b1e (2023-07-26) (no ssh)

V1.00(ABVJ.1)b1i (2026-02-06) (no ssh, known compatibility issues)

V2.50 is based on OpenWrt 14.07. Wind Tre (Italy) upgraded to this branch at the end of 2022.

V2.50(ABVJ.1)b1d (2023-04-21)

V2.50(ABVJ.1)b1f (2023-07-14)

Both branches are maintained separately, so a 1.00 image can have a later build date than a 2.50 image.

Please leave a comment if you have any other flash dumps.

Creating image files

Create flash dump of mtd2 or mtd3 (Image A / Image B):

dd if=/dev/mtd2 of=/tmp/mtd2

Download flash dump from SFP (e. g. using TFTP).

Download header file and add it to flash dump:

cat header mtd2 > firmware.upf

Copy software version string from flash dump to header:

dd if=firmware.upf of=firmware.upf bs=1 skip=632 seek=124 count=32 conv=notrunc

Get CRC32 of firmware.upf:

v=$(cat firmware.upf | gzip | tail -c 8 | head -c 4 | hexdump -e '1/4 "%08x"')

Convert CRC32 to binary and write it to header:

echo -e -n "\x${v:0:2}\x${v:2:2}\x${v:4:2}\x${v:6:2}" | dd of=firmware.upf bs=1 seek=104 conv=notrunc

header

Zyxel_PMG3000-D20B_V1.00(ABVJ.0)b3s_2020-12-23.zip

Zyxel_PMG3000-D20B_V1.00(ABVJ.0)b3v_2021-05-08.zip

Zyxel_PMG3000-D20B_V1.00(ABVJ.1)b1e_2023-07-26.zip

Zyxel_PMG3000-D20B_V1.00(ABVJ.1)b1i_2026-02-06.zip

Zyxel_PMG3000-D20B_V2.50(ABVJ.1)b1d_2023-04-21.zip

Zyxel_PMG3000-D20B_V2.50(ABVJ.1)b1f_2023-07-14.zip

I was using V2.50(ABVJ.1)b1f, yes. This has SSH and worked just fine (Deutsche Telekom infrastructure / ISP Telefonica o2). Switching between V1.00 and V2.50 images works just like any other update.

I've now switched to V1.00(ABVJ.1)b1i and will probably keep using this. Works fine for me and I don't really need SSH (although it would be nice of course).

Does V1.00(ABVJ.1)b1i handle 2.5G ? Currently running V1.00(ABVJ.0)b3v and trying to get 2.5G working which does not seem to work correctly on that version.

Also strange that I am still on V1.00(ABVJ.0)b3v even though Telekom is my ISP.

@digaus I never tried 2.5G since I use the module in a "traditional" SFP slot (1G only).
But I think 2.5G needs to be enabled via SSH and since b1i doesn't have this, your chances are probably better with b3v.
Or you could try a V2.50 image.

Who gets automatic updates and who doesn't does indeed seem to be somewhat random.

@digaus I never tried 2.5G since I use the module in a "traditional" SFP slot (1G only). But I think 2.5G needs to be enabled via SSH and since b1i doesn't have this, your chances are probably better with b3v. Or you could try a V2.50 image.

Who gets automatic updates and who doesn't does indeed seem to be somewhat random.

Used last 2.50 firmware which now works nicely with 2.5G out of the box. No settings changes necessary👍🏻

Now getting full bandwidth of my 1000/500 connection 🙂