Unlocking BT 2Wire 2700HGV Business Hub (wireless router)


Contents > BT v5.29 firmware:




Setting up the 2700HGV (BT v5.29.x firmware)

+ Easy to unlock using Javascript save method.  WPA2-PSK(AES) wireless security.  4 wireless power level settings hack (25 - 100mW).  Wireless MAC Filtering (v5.29.117.x)

-  BT v5.29.117.6 and certain editions of v5.29.107.19 are susceptible to upgrade to BT v6 OpenZone firmware. (Consider  changing the ACS URL to block the upgrade, or installing alternative firmware) 


If you have acquired a brand new and unused hub loaded with BT v5.29.117.6 firmware, you may wish to block any possible upgrade to BT v6 firmware.   Click here for details before you connect it to the internet.

The BT v5.x firmwares will by default will usually only permit BT usernames to be saved.

There are now two methods described on this page for how to save non-BT PPP usernames and passwords.

Javascript Save Method


Applies to all models of 2700HGV with v5.29.x firmware.


                                               or type                         home




(update Dec 08): I have come across two cases where owners have had difficulty configuring their 2700HGV hubs.  One was a Mac owner using Safari web browser, and more recently 'Gene' was struggling with a Vista PC with Internet Explorer - he eventually resolved the problem by using another Vista PC.   I'm speculating the 2700HGV web interface may be sensitive to certain web browsers or computer setups.   If you encounter this issue, please try this alternative method - you will need to use a Windows PC with Opera web browser installed.
(update 14 Mar 10):  Arctophile from idnetters forum reports a recently acquired spare V5.29.117.6 router took about 15 min before the broadband light turned green after first entering my username and password using the JavaScript method. He thinks this MAY have been due to the router trying (and failing for a couple of attempts) to contacting BT/2Wire servers before connecting to my ISP.   The router was connected to a Vista PC running IE8.  (Editor's note:  the behaviour of the Broadband LED should be independent of any ppp login attempt)
(update 4 Mar 12): burakkucat runs RHEL6.2 on his laptop. After upgrading FireFox from 3.6 to 10.y, he discovered javascript method does not work any more.

HURL13 Trick

(new 4 Mar 12)

burakkucat has discovered the HURL13 trick usually used for BT v6.x firmwares also seems to work with BT v5.x firmwares too. Specifically BT v5.29.107.12 was used.


Additional Notes


If you use BE/o2 LLU broadband, please refer to separate section called 'BE/o2 LLU Settings' on this page describing what settings to use.


Disabling unused interfaces


If you are using BT v5.29.x firmware, you may also wish to take the opportunity to disable the wireless network assigned to 'Fusion Devices'.




Advanced Firewall Settings






Installing Enhanced Services for hubs using BT v5.29.107.12 or v5.29.107.19 Recovery firmware


Update (June 2008):  I have a suspicion that BT have now decommissioned the provisioning servers at    smehomehubrms.bt.com    so the following procedure will probably not work for early BT hubs.   

Update (Mar 2009):  A reader has reported success with installing Enhanced Services on their 2700HGV with BT v5.29.107.12 recovery firmware by changing the ACS URL to point to alternative 2wire.com server. 

Update (30 Sep 09):  I can confirm Enhanced Services can be installed if a 2700HGV Dual SSID hub which has been flashed with BT v5.29.107.19 recovery firmware.

Click here for details for how to change the ACS URL to enable Enhanced Services using 2wire.com servers.

If you have specifically installed the BT v5.29.107.12 or v5.29.107.19 recovery firmware files, you do not need to change the ACS URL if you simply wish to block any firmware upgrades.   These firmwares attempt to poll a non-existent BT provisioning server.


Enhanced Services on BT v5.29.107.19 or BT v5.29.117.6 firmwares configured to use BT motive.com servers


For BT v5.29.117.6 firmware, Enhanced services should install itself automatically but please be aware that BT are deploying their new v6.x OpenZone firmware during 2009, and there is a very high risk that any hub with v5.29.117.6 firmware will be automatically upgraded - it could happen immediately or it may takes days/weeks. 

Click here for details for how to change the ACS URL to block the BT v6.x firmware updates.


To manually install the ‘Internet Access Controls’ and ‘Content Screening’ application modules: 

                                        or type                        home 

528Y-27G4-A222-22BJ-B22V        or




Using System Setup Wizard


If your ISP has provided you with a BT wholesale IPstream broadband connection, an alternative simple workaround is to enter the username and password by executing the Setup Wizard..  Warning:  if your hub has Enhanced Services such as Parental Controls already present, the use of the setup wizard may result in the services being deleted. You may not be able to recover the Enhanced services once they have been deleted.

Warning: If the hub is using BT v5.29.117.6 firmware, use of the System Setup Wizard and entering the default BT keycode, may reset the ACS URL back to BT motive.com server, and make the hub vulnerable to BT's automatic v6.x firmware upgrade. 




Other information


The following paragraphs describe the features of the Dual SSID hub and v5.29.x firmwares.


BT Dual SSID Fusion models have revised hardware (version 2701-100589-005) and begin with assembly no 4201-003003-007 or 008.  The router may come with factory installed v5.29.107.12 firmware or later.   


I notice from the router's Detailed Log and Provisioning Information page, The Dual SSID models connect to a different BT provisioning server, 'pbthdm.bt.motive.com' for models manufactured from around week 16 in 2007 and onwards.  

Note that earlier some Dual SSID hubs with v5.29.107.x firmware, or any hub using the BT v5.29.107.12 or v5.29.107.19 Recovery firmwares will in fact try to connect to the old cwmp.cms.smehomehubrms.bt.com server.   

The 'Wireless Settings' page does not display the Wireless Power Setting.  It is however possible to edit the power level setting using this described here.   The factory default setting is '1' (25mW).  

As well as Fusion wireless VOIP services, the v5 firmware now also supports WPA2-PSK (AES) wireless security.  I do not use VOIP or WPA2-PSK so I will not be commenting on these features.

The Dual SSID model connected to my BT IPstream ISP without any difficulties. ADSL line speeds are comparable to what I have been witnessing with my other Single SSID 2700HGV hub.

My Dual SSID hub was running v5.29.107.19 but it upgraded automatically to v5.29.117.6.  


Components version information

BT v5.29.107.12 (ACS URL: https://gw-5-29-117.cwmp.cms.2wire.com)

Note: Using BT v5.29.107.12 recovery firmware


BT v5.29.107.19 (ACS URL: https://gw-5-29-117.cwmp.cms.2wire.com)

Note: Using BT v5.29.107.19 recovery firmware.


BT v5.29.117.6 (ACS URL: https://gw-5-29-117.cwmp.cms.2wire.com)

Note: ACS URL has been changed to block v6 upgrade.

Enhanced Services cannot be installed from 2wire.com servers.




Next Page: BT Provisioning Server Settings

Use 'Back' button to return to previous page or click here to return to main menu