How to hack your ZTE 4G router to connect more than 10 devices

This document outlines how to allow connecting more than 10 devices to your ZTE 4G router. By default, a ZTE MF920V 4G router allows only for 10 devices (computers, tablets, phones) to connect to it simultaneously at any given point in time.

Disclaimer: If you choose to follow this guide, you do so at your own risk. I am not responsible for any actions you choose to undertake. The below works for me, it might not work for you, and it may cause some unexpected/unintended results for you. As always, proceed with caution and certainly don’t attempt to perform this action on a network you cannot afford to get downtime on. Making changes on any router usually requires some type of restart, so all devices on the network may see their connection interrupted at some point during this article.

The below has so far only been tested on a ZTE MF920V 4G router, but I’d say it’s safe to assume it could work for similar ZTE 4G routers as well.

More visually, here’s what we’re trying to achieve (on our WLAN, 192.168.0.1 is the router’s IP address):

At the end of this short article, you’ll be able to connect more than the factory-default 10 devices to your ZTE 4G router.

Steps how to connect more than 10 devices to your router at once

Download and install Postman | The Collaboration Platform for API Development onto your computer.
While Postman is downloading, figure out what is your ZTE router’s IP address and password. In this example case, the IP was 192.168.0.1. If you don’t know the password, try ‘admin‘ (without the quotes).
Connect to your ZTE router via a browser, preferably Chrome or Edge (for the sake of ease of following this article, so that the screenshots here match what you see on your screen).

Enter the IP address of your ZTE router into the address bar. You should see the following appear in your browser’s address bar: http://192.168.0.1/index.html#login.

Having successfully logged in, press F12 in your browser to open the development environment, and then navigate to ‘WLAN settings’ on the ZTE router’s user interface.

Meanwhile, make sure the ‘Network’ tab is the active tab in your browser’s development environment.

Although our goal is to go beyond the maximum selectable amount of 10 simultaneous devices, for now we select “10” as the value under “Max Station Number” in “Wi-Fi Settings”. It’s important not to modify anything else on this screen. DO NOT delete or modify your SSID, security mode, password, and the likes.

Click “Apply” after setting max. station number to 10.

Affirm the “All connected Wi-Fi devices will need to reconnect. Do you want to continue?” pop-up with the “Yes” button. You should not experience any serious disruption, however some (if not all) devices may disconnect briefly.

While the router is applying the ‘new’ settings, look for the network log item entitled ‘goform_set_cmd_process‘ that does not have any URL parameters behind it. There’s only one:

Right click the log item entitled ‘goform_set_cmd_process‘, follow through to the ‘Copy’ menu, then click ‘Copy as cURL (bash)’.

Now some very important information is copied to your memory. It’s therefor vital in the meantime not to copy-paste anything new to clipboard (in general).

Since our first step was to “Download and install Postman | The Collaboration Platform for API Development onto your computer.”, it is now time to open Postman.

Click the ‘Import‘ button inside Postman.

In the popup that appears next, select the ‘Raw text‘ tab.

Now, paste in the text that we copied from our Chrome/Edge browser F12 developer tools a couple steps earlier.

You should now see a text that looks very similar to: (do NOT copy-paste the text from this article, stick to your own in-memory text!)

curl 'http://192.168.0.1/goform/goform_set_cmd_process' \
  -H 'Connection: keep-alive' \
  -H 'Accept: application/json, text/javascript, */*; q=0.01' \
  -H 'X-Requested-With: XMLHttpRequest' \
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36 Edg/87.0.664.75' \
  -H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' \
  -H 'Origin: http://192.168.0.1' \
  -H 'Referer: http://192.168.0.1/index.html' \
  -H 'Accept-Language: en-US,en;q=0.9,nl;q=0.8,fr;q=0.7,ro;q=0.6,sl;q=0.5' \
  --data-raw 'goformId=SET_WIFI_SSID1_SETTINGS&isTest=false&ssid=XXXXXXX&broadcastSsidEnabled=0&MAX_Access_num=10&security_mode=XXXXXX&cipher=1&NoForwarding=0&security_shared_mode=1&passphrase=XXXXX\
  --compressed \
  --insecure

Before clicking ‘Continue’, in the pasted text, change “MAX_Access_num=10” into “MAX_Access_num=20“. Do not change anything else.

That is the part of the command telling your ZTE router to increase the maximum number of access points beyond the limit enforced by ZTE’s default user interface (10) to 20 (in this case).

You can try experimenting with a larger number, but for me, 20 will do, as there’s probably a reason ZTE set 10 as the default “maximum”. The small 4G router probably cannot handle many more clients under circumstances in which it gets hit with heavy network traffic.

In the end, we end up with something like: (do NOT copy-paste the text from this article, stick to your own in-memory text!)

curl 'http://192.168.0.1/goform/goform_set_cmd_process' \
  -H 'Connection: keep-alive' \
  -H 'Accept: application/json, text/javascript, */*; q=0.01' \
  -H 'X-Requested-With: XMLHttpRequest' \
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36 Edg/87.0.664.75' \
  -H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' \
  -H 'Origin: http://192.168.0.1' \
  -H 'Referer: http://192.168.0.1/index.html' \
  -H 'Accept-Language: en-US,en;q=0.9,nl;q=0.8,fr;q=0.7,ro;q=0.6,sl;q=0.5' \
  --data-raw 'goformId=SET_WIFI_SSID1_SETTINGS&isTest=false&ssid=XXXXXXX&broadcastSsidEnabled=0&MAX_Access_num=20&security_mode=XXXXXX&cipher=1&NoForwarding=0&security_shared_mode=1&passphrase=XXXXX\
  --compressed \
  --insecure

Again, it’s important not to change anything else (in this article, we have censored our own network data, hence the XXXXXXX’s).

Next, click the ‘Continue‘ button.

Then, click ‘Import‘.

Finally, click ‘Send‘.

This will send the same command to the router as the browser did earlier, except that we have ‘upgraded’ the ZTE router to its intrinsic capacity of more than 10 simultaneous network clients (laptops, pc’s, tablets, phones…). We have now sent a command to the router to allow up to 20 devices to connect at once, much like as if we would have selected ’20’ from the dropdown box in one of the earlier screenshots – instead of ’10’.