Zyxel root/supervisor password retrieval

Zyxel_root.md

1. This document lists the known root/supervisor password retrieval commands, for modern zloader-based password protected Zyxel devices, such as EE3301-00, WE3000-00.
2. This assumes that you have gained root shell access, for instance by following the steps described at https://pete.akeo.ie/2026/09/gaining-root-access-on-zyxel-ee3301-and.html.
3. If your device is not listed here, and you would like to see it appear, please e-mail pete@akeo.ie.
4. From a root shell access on your device, you should enter the commands described exactly as follow. Do not be tempted to add or remove spaces. Just copy paste.
5. You should remove all trailing spaces from the password being displayed.

Zyxel EE3301-00

KEY=867536be13efbe07630544947f584331c2d2e0edf011c9fd74f45db8cf2fec32
IV=131aa4324028e14ace263b08db674e04
fw_printenv | grep supervisor | cut -c 12- | openssl base64 -d | openssl enc -aes-256-cbc -nosalt -nopad -d -K $KEY -iv $IV

Zyxel WE3300-00

KEY=734eaa5ffe1187f40151cbb0142dac00e25b874f5f33343bbd83eda2dbd2ac8d
IV=311cc8d8b061b12577185b43333c4031
fw_printenv | grep supervisor | cut -c 12- | openssl base64 -d | openssl enc -aes-256-cbc -nosalt -nopad -d -K $KEY -iv $IV