Unlocking BT 2Wire 2700HGV Business Hub (wireless router)


Contents > BT v6.1 firmware:




BT firmware v6.1.1.48.x information 

Deployed in 2009 to existing BT 2700HGV hubs running v5.29.117.6 firmware.

(Jan 2014): BT are still deploying v6.3.9.63 firmware to existing BT 2700HGV hubs running v6.1.1.48.x firmware. You may wish to use Adrian C's static route hack to block the update if you prefer v6.1 firmware.

'Zedman' from The-Scream forums reports his Dual SSID hub has been automatically upgraded to the new v6.1.1.48 firmware.

His 2700HGV Hub details:

Dual SSID model, assembly no. 4201-003003-007

Prior to upgrade: Official BT v5.29.107.19

DNS poison entries    pbthdm.bt.motive.com    &     cwmp.cms.smehomehubrms.bt.com

ISP is BT 'Home' Broadband.

The above DNS poison entries failed to block the firmware update to v6.1.1.48.   (I seem to recall when I used to use BT v4.25.33 firmware on a Single SSID hub in late 2006, the DNS poison entry also failed to block an automatic upgrade to v5.29.107.x at the time) 


'Zedman' also tried to manually downgrade the firmware.

The home/tech/upgrade page does not work.

The home/upgrade page is accessible but any attempts to downgrade the firmware appears will fail with the following message when using v5.x recovery firmware:

The upgrade was unsuccessful.
Unfortunately, the software upgrade could not be completed.
Please click "Back" to try again or click "Cancel" to return to the gateway page.
Failure detail:


The home/mdc page is also no longer accessible. 


Some screen shots of the new firmware for the 'Home', 'Settings' and 'Site Map' pages.  





Some pages which were previously only accessible via the Management Console, now appear to have been relocated for easier access.  eg. DNS resolution table and access to System logs.




The hub also polls the provisioning server:        pbthdm.bt.motive.com


Once again, a big thank you to 'Zedman' for the information and pictures provided so far on this new BT v6.1.1.48 firmware.



Frequently Asked Questions:



v6.1.1.48-enh.tm is the version number of the new BT firmware which is gradually being rolled out by BT to their business customers with main rollout apparently starting from November 2008.

Firmware versions reported to me since February 2009 appear to be:



The new v6 firmware enables BT OpenZone hotspots to be created.



Yes it appears BT v6 firmware can be unlocked for any ISP !

Well done Simon, he deserves a medal.  I can confirm too I am able to change and save settings in the Setting > Broadband > Link Configuration page too.

Simon also notes that after the factory reset, the OpenZone function was enabled by Default.   When he clicked the 'Disable' button, the status changed to 'Pending' with an explanation message:

The changes may not be instantaneous. It could take up to 30 minutes for the service to be fully enabled or disabled because of the need to communicate with the BT network. The status shows as pending until this process has completed.

With my own hub which was recently upgraded to v6., it took 2 or 3 working days to enable or disable OpenZone.


Wireless Power and other available Settings

(Update 3 Jul 09):  We have got hold of the HTML source code for the wireless settings page provided Telecom v6.1.1.43 firmware which supports wireless power setting.  Unfortunately, we are still unable to hack the BT v6. firmware - 2wire have well and truly blocked any attempt to adjust the wireless power setting in the BT branded v6 firmware.

'Simon' also notes that on the Settings > LAN > Statistics reporting page, the wireless power is displayed and appears to be set to '1' on his hub, but there is no means of changing the value as this is an information only reporting page.  My own hub still reports a value of '2' which was how I had previously configured the wireless power prior to the forced v6.x upgrade.



My hub offers 13 wireless channels.   Simon reports his hub also offers an 'Auto' option.





New features

I don't recall this feature being available on v5 firmwares but you can now set the speed of the four individual ethernet ports.



(Added 7 Mar 09) According to this BT webpage, all brand new factory shipped BT 2700HGV hubs with v6.1.x firmware pre-installed since January 2009 appear to have a default system password.  The password corresponds to the serial number of the hub.   The serial number can be found on the label attached to the underside of the hub.


Removed Features

If you need to clone the hardware MAC address of your ISP supplied modem or router, to a 2700HGV with BT v6 firmware, I'm afraid this is no longer possible.

Similarly, it is no longer possible to define a HOST name for the hub.




Next Page: BT v6.1 Technical Issues and Bugs

Use 'Back' button to return to previous page or click here to return to main menu