Unlocking BT 2Wire 2700HGV Business Hub (wireless router)

 

Contents > In the beginning....:

 

 

 


Identifying BT 2700HGV model 

 

The British Telecom (BT) supplied 2700HGV hubs are often referred to as 'single' or 'dual' SSID models.  This refers to whether the label on the rear of the hub has two SSID and wireless security keys printed as shown on the right of the two pictures below.   This method of labelling appears to be unique to BT branded 2700HGV models.  For models made for other ISPs in other countries, you should not use this method of identification - you should instead identify the 'Hardware Version' of the hub as described later in this page.

   

First generation 2700HGVs manufactured in early 2006 for BT are supplied in a predominantly white multicoloured box with splashes of colour including red and orange, but BT changed to shipping them later in white & grey boxes from late 2006 onwards up to the present day. 

The first four digits of the serial number is printed on the label which can be found on the underside of the 2700HGV hub.  The serial number can be used to identify the original  manufacture date from my experience of using previous 2Wire routers.  The first two digits represent week of manufacture and next two digits representing year of manufacturer.  Where the serial number commences with a '9', it should be interpreted as a '0'.  eg. 9307 would represent week 3 of 2007.  1407 would represent week 14 of 2007.

The number printed beneath the lower bar code is the 'Assembly Number' (or 'Part Number') and usually begins with '42'.  An Assembly number beginning with 4200 is usually associated with hubs with Hardware versions beginning with 2700 (see below).  Similarly, Assembly  no. beginning with 4201 is usually associated with Hardware versions beginning with 2701.

Tip: The serial number is also duplicated onto the labels attached to the outside of the cardboard shipping box.  If you are planning to purchase a brand new sealed boxed BT business hub, you can use the manufacture date information contained in the serial number to try and determine what the 'Assembly/Part Number', 'Hardware version' are likely to be.  If the hub is still in its sealed bag, then the factory installed firmware on the hub should be as listed below for the relevant Assembly/Part Number.

 

The example opposite shows a serial number commencing '9408'.  This hub was manufactured in week 4 of 2008, and is likely to be for a hub which has Assembly No. 4201-003003-008 with factory installed BT firmware v5.29.117.6

 

 

Hardware Version

The Hardware version can be found by logging onto the hub.  It usually begins '2700' or '2701'.  The 'Hardware version' is particularly important because it indicates a subtle change in the hardware, despite BT choosing to retain the generic model number '2700HGV' for the later 2701 hardware version introduced in early 2007.

                            

 

The factory default key code used by BT is 528Y-27G4-A222-22BJ-B22V . On hubs running v4 or v5 firmware, it is possible to change the key code. It cannot be edited on v6 firmwares.



The following list of Assembly/Part numbers is by no means complete or accurate.  The firmware versions listed below are believed to be what was installed onto the hub when it was manufactured.   Please note that BT regularly upgrade the firmware on all 2700HGV hubs.  As a result, the firmware that may be present on an 'used' example of a BT 2700HGV hub is likely to be newer than the version which was originally installed at the factory.



BT Business Hub v1.0

 

 

 

 

 

BT 2700HGV (2006)

Assembly no. 4200-003003-003 (Added 10 Aug 10)

  • Hardware version: 2700-100588-005

  • Single SSID printed on label.

  • factory shipped firmware v4.25.23

  • Wireless power: 25mW (default) to 400mW (hacked) with v4 firmware

  • Serial no commences 1706 (Tnx to Peter-G)

Assembly no. 4200-003003-004

  • Hardware version: 2700-100588-005

  • Single SSID printed on label.

  • factory shipped firmware v4.25.27

  • Wireless power: 25mW (default) to 400mW (hacked) with v4 firmware

  • First appeared early 2006.

Assembly no.4200-003003-006    

  • Hardware version 2700-100588-005

  • Single SSID printed on label

  • factory shipped with ??? firmware.

  • Wireless power: 25mW (default) to 400mW (hacked) with v4 firmware

 

 

 









BT Business Hub v2.0

 

 

 

 

 

 

 

 

 

 

 

 



 

BT 2700HGV (2006-2010)

Assembly no.4200-003003-006

  • Hardware version 2700-100588-005

  • Single SSID printed on label.

  • factory shipped firmware v4.25.33

  • Wireless power: 25mW (default) to 400mW (hacked) with v4 firmware

  • First appeared in late 2006.

Assembly no.4201-003003-006

  • Hardware version 2701-100588-005

  • Single SSID printed on label.

  • There may be a problem using SBC v4.25.19 recovery firmware on this model

  • factory shipped firmware v4.25.33

  • First appeared in late 2006.

Assembly no 4201-003003-007

  • Hardware version  2701-100589-005

  • Dual SSID printed on label.  

  • This must NOT be flashed with SBC v4.25.19 recovery firmware.

  • factory shipped firmware v5.29.107.12 or 19

  • Wireless power: 25mW (default) to 100+ mW (hacked) with v5 firmware

  • Thanks to 'Tim' for this information (Aug 09):

    • Earliest known serial no. commences 9307.  Jan'07 production

Assembly no 4201-003003-008

  • Hardware version  2701-100589-005

  • Dual SSID printed on label.  

  • This must NOT be flashed with SBC v4.25.19 recovery firmware.

  • factory shipped firmware v5.29.117.6 

  • Wireless power: 25mW (default) to 100+ mW (hacked) with v5 firmware

  • First appeared towards the very end of 2007.

    • Earliest known serial no. commences 4207.  Sept'07 production. (Tnx to Bill P., Sep 10)

    • Last known serial no. commences 4208.  Sep'08 production. (Tnx to 'Richard E.', Jul 12)


 

Assembly no 4201-003003-008 (BT OpenZone enabled)

  • Hardware version 2701-100589-005

  • Dual SSID printed on label.  

  • factory shipped firmware v6.1.1.48-enh.tm

  • The firmware on this model cannot be downgraded to an earlier v5 version.

  • Max wireless power: 25mW with BT v6 firmware (Cannot be hacked)

  • Thanks to 'Ian' for this information:

    • First examples appeared towards end of 2008.  

    • Earliest known serial no. commences 4308.  Oct'08 production

    • (Added 14 Mar 10): Arctophile from idnetters forum notes that his new v6 hub with manufacture date 1109 (Mar'09) appears to have been manufactured in China.  Previous 2700HGV hubs have always come from Malaysia.





Assembly no 4201-003003-008 (BT OpenZone enabled)

  • Hardware version 2701-100589-005

  • Dual SSID printed on label.  

  • factory shipped firmware v6.1.1.48.1-enh.tm

  • The firmware on this model cannot be downgraded to an earlier v5 version.

  • Max wireless power: 25mW with BT v6 firmware (Cannot be hacked)

  • First examples appeared probably from mid 2009.  

    • Earliest known serial no. commences 4109. Sep'09 production (likely to be earlier models made in 2009)








BT Business Hub v3.0

ADSL boxed edition





Fibre boxed edition

BT 2701HGV-C (2010-2012)

(Includes details and images kindly provided by MHC)



BT Business Broadband has been shipping the 2Wire 2701HGV-C model router since late 2010, initially for Fibre broadband installations, but later for ADSL installations. The hub is identical for both types of installations. Only the documentation and the cables differ within the shipping boxes.

The firmware permits the hub to be used with either an ADSL connection, or it can be connected to an external modem, via ethernet cable, for BT Fibre broadband installations.



A Box Part number, and the serial number of the hub can be found beneath the two bar codes printed on the label attached to the side of the white shipping box. (Similar to the one shown near the beginning of this web page)



Box Part No. 1001-403004-001 (ADSL boxed edition)

  • Shipping box labelled 'BT Business Hub'.

  • Item code: 052909, Item: BT Business Hub

  • ADSL Documentation,

  • 1x RJ45-RJ45 ethernet cable.

  • 1x RJ11/12-RJ11/12 cable.

  • 2x ADSL microfilters.




Box Part No. 1001-403005-001 (Fibre boxed edition)

  • Shipping box labelled 'BT Business Hub: Fibre'

  • Item code: 049311, Item: FTTC Business Eth Hub

  • Fibre Documentation

  • 2x RJ45-RJ45 ethernet cables.

  • 1x RJ11/12-BT431A cable

  • There are no microfilters or RJ11-RJ11 cable for ADSL use.















At the time of writing, we are only aware of two different revisions of 2701HGV-C hubs. The part number can be found on the label attached to the underside of the hub.




Part No. 4201-003004-001

  • Hardware version 2701-100630-008 

  • factory shipped firmware v6.3.9.41-plus.tm (2+GB file download bug)

  • Default wireless power: 75mW

  • Thanks to 'MHC' for the earliest manufacture information (updated: Oct 11)

    • Serial no.s beginning 3410, circa July 2010.

    • Newest example serial no. 2611 Chris Z. (This post dates some -009 models)

  • Some models have 'Content screening' or 'Access Controls' enhanced services.





Part No. 4201-003004-002

(Added 19 Oct 11, thanks to 'Dave A')

  • Hardware version 2701-100630-009 

  • factory shipped firmware v6.3.9.41-plus.tm (2+GB file download bug)

  • Default wireless power: 75mW

  • Thanks to 'Dave A' for the earliest manufacture information

    • Serial no.s beginning 2211, circa May 2011. (This predates some -008 models)

  • No 'Content screening' or 'Access Controls' enhanced services.






If you have purchased a sealed BT Business Hub and it is manufactured outside of the production date ranges indicated above for a particular Assembly/Part number, please drop me an email. Please include details of the Hardware version and shipped firmware version.




BT Business Hub 3 (2012 - present)

(Updated 29 Jan 2012)

Details have started to emerge for the new 'BT Business Hub 3' (BH3 ?) on the Help pages of BT Business.

The images contained in the User Guides suggest the new Business Hub will resemble the BT Home Hub 3. Planned availability perhaps from March 2012.

There has been two revisions of the BT Home Hub 3. The original type A version was made by Siemens Gigaset (Sagem) and I believed used an Infineon/Lantiq chipset with Atheros wireless. The recently released type B revision is made by Huawei and is confirmed by Asbokid as being a Broadcom design (Photos by burakkucat can be seen here).

Also it will support both ADSL and fibre connections through a WAN ethernet port.

The Home Hub 2 and 3 models can be used with most BT owned ISPs, such as PlusNet. The BT Home Hub 3 Type A (HH3A) can be specifically unlocked for most ISPs but it seems the HH3A also suffers from problematic wifi, ethernet/gigabit issues and the orange light of death. Unlike the HH3A, there appears to be far fewer issues with the new Broadcom based HH3B.

At the time of writing, I have no plans to create dedicated pages for the new BH3 model and how to unlock it, as this is likely to be covered in future by psidoc.com given the similarity to the HH3 model.

One of many YouTube Unboxing videos for BT Home Hub 3 (type B)



(Added 30 Mar 2012): The somewhat bad news is Asbokid has confirmed the new BH3 uses the Lantiq XWAY ARX-168 chipset after opening one up to examine the PCB to discover it is identical to the HH3A. The label on the underside of the new BH3 can be seen here, the MAC address beginning 9001 is assigned to Sagecom. The plain brown shipping box has a label with an identifying BT item code: 064422. See also this message thread on Kitz forum.



 

The 2700HGV/2701HGV-C hubs and mains power adaptors are each packed in their own individual sealed polythene bags when brand new.  The serial no. of the hub is also printed on the external packaging.  The specific Assembly (Part) no. you require can only be found on the label attached to the hub.



 

 


BT Firmware releases

 

BT 2700HGV  (manufactured 2006 to 2010)

Date

Version

Comments

Early 2006

v4.25.23

 

2006

v4.25.27

 

2006

v4.25.33

 

Early 2007

v5.29.107.12

v5.x adds support for Fusion wireless VOIP.  The term 'Dual SSID' refers to newly manufactured hubs from 2007 featuring a label quoting two SSIDs - one for the regular wifi network, the second for the Fusion wireless network.

2007

v5.29.107.19

 

Early 2008

v5.29.117.6

 

Late 2008

v6.1.1.48-enh.tm

All new GUI. BT OpenZone functionality added. (third SSID). Only found pre-installed on new hubs.

March, 2009

v6.1.1.48.1-enh.tm

Across the net upgrade.

Mid 2009

v6.1.1.49-enh.tm-KME

Used to be offered to BT Business Broadband customers who were experiencing VPN problems on port 500.

October, 2011

v6.3.9.63-plus.tm

Some v6.1 bugs fixed. Fusion wireless removed. New bugs added. Across the net upgrades apparently suspended around 3 Nov 11. Upgrades resumed on 19 Dec 11 for 2701HGV-C only.

Problem with downloading very large files highlighted when OSX Mountain Lion (4+GB) was released in summer 2012. (updated Oct 12)

(Jan 2014: Installed a replacement 2700HGV running v6.1.1.48.1 for a BT Business broadband user. It was updated to v6.3.9.63 four days later)

 

All 2700HGV business hubs with BT firmware are configured to poll one of two provisioning servers.  These servers amongst other things, can push automatic firmware updates to the connected hubs.   Automatic firmware updates cannot normally be blocked by the user.

Earlier BT firmwares up to and including v5.29.107.19 were configured to poll the provisioning servers at smehomehubrms.bt.com

BT v5.29.117.6 was the first firmware to begin using the new provisioning servers at bt.motive.com

 

By early 2008, many active BT 2700HGV hubs will have by now been upgraded to v5.29.107.19 or v5.29.117.6 firmwares.

 

We believe some time in 2008, BT stopped using the provisioning servers at smehomehubrms.bt.com. Which was used by BT v4 and v5 firmwares. To ensure continued support for active hubs running v5.29.107.19 firmwares, BT pushed a configuration update to these hubs.  The change was to configure the hub to poll the new bt.motive.com servers, and so ensure the earliest 2700HGVs still in service, would in future continue to have the same functionality as newer BT 2700HGV hubs when newer firmwares are released.

Today, any BT 2700HGV hub currently using firmware version up to v5.29.107.12, will never be upgraded automatically to a later firmware release by BT.

Hubs with BT v5.29.107.19 firmware and were in regular active service since early 2008 and into 2009, would have been upgraded to v5.29.117.6 and subsequently to v6.1.1.48.1-enh.tm as part of BT's upgrade plans during 2009. Today, I believe any hub still running BT v5.29.107.19 firmware will not be upgraded.

 

 

BT 2701HGV-C  (manufactured 2010 to 2012)

Date

Version

Comments

Late 2010

v6.3.9.41-plus.tm

Problem with downloading very large files with early models where Content Screening & Access Controls is present. Click here for more details. (updated: 7 Oct 11)

Nov 2011

v6.3.9.63-plus.tm

New bugs added. If Content Screening & Access Controls was present prior to the upgrade, it appears to be retained after the upgrade. Across the net upgrades apparently suspended around 3 Nov 11. Upgrades resumed on 19 Dec 11.

Problem with downloading very large files highlighted when OSX Mountain Lion (4+GB) was released in summer 2012. (updated Oct 12)

(Jan 2014): See above comment for 2700HGV v6.3.9.63 firmware. It is possible BT are still rolling out this firmware to hubs running v6.3.9.41.

 

More information about this firmware can be found here



 


Unlocking Options

Important: Please note that the photos of the labels and information contained here are for the British Telecom branded 2700HGV hubs offered in the UK.  Please read the previous section carefully to identify your BT 2700HGV hub before proceeding.  If you accidentally install the SBC v4.29 Recovery firmware onto a later model hub, you will damage it.  There is no way of recovering from this situation.

 

BT Business Broadband may also be blocking hubs which have SBC or SingTel firmwares installed.  If you are a BT business broadband customer, I do not recommend changing the firmware.

 

    BT 2700HGV - Single SSID model

If you have an early BT 'Single SSID' label with assembly no. 4200-003003-004 to -006.  ie. Hardware version 2700-100588-005.



 

If you have an early BT 'Single SSID' label with assembly no. 4201-003003-006.  ie.  Hardware version 2701-100588-005.

 

 

 

    BT 2700HGV - Dual SSID model

If you have a later BT 'Dual SSID' label with assembly no. 4201-003003 -007 and 4201-003003 -008.  ie. Hardware version 2701-100589-005

 

 



BT 2701HGV-C

More information about the v6.3.9.41 firmware can be found here. Otherwise, the BT 2701HGV-C can be unlocked to for use with most ISPs using the existing procedure for the BT v6.1 firmware.







 


Previous Page: Introduction

Use 'Back' button to return to previous page or click here to return to main menu