Telsey CPVA642XF

This is a Fastweb (italian ISP) router with voip and usb port

Get a shell

  1. enable telnet server (via web interface)
  2. connect via telnet to your device using web interface credentials
  3. type the undocumented “sh” command
  4. enjoy your root shell!

Official firmware releases

"Native" software


Available soon!


Available soon!

Known issues


Latest device was shipped with the very old Linux kernel WITHOUT swap support. Swap support can't be compiled as module so you should be careful with memory usage.


  • For some strange reason in VoIP configuration the option “Interface name” must be the internal lan, not wan. - Fixed in latest firmware revision (3.7.130V-sip)
  • Some phones doesn't show caller-id - Fixed in latest firmware revision (3.7.130V-sip)

Telnet service

  • If you activate telnet on wan interface the service is reachable over this interface but the router won't accept admin credential
  • telnet capabilities was limited, ncurses based application and others could works bad.


OpenWRT porting was done for a similar model that differ only for half size ram and flash. FXS/FXO ports are not working on OpenWRT (to be verified). I prefer keep the original firmware and extend its functionality.


  1. Download latest busybox for mips
  2. Download a brcm63xx generic jffs2-128k image (backfire link)
  3. Mount it on your computer (take a look in how-to section on Linux page) and copy contents making a tar archive to preserve permissions
  4. Unpack rootfs and move busybox on the drive to be attached to your Telsey
  5. Eject drive from your computer and attach it to your Telsey
  6. Login via telnet and enter in root shell
  7. Copy system files and bind system folders inside chroot
    cp /etc/hosts $CHROOTDIR/etc/hosts
    cp /etc/fstab $CHROOTDIR/etc/fstab
    cp /etc/resolv.conf $CHROOTDIR/etc/resolv.conf
    mount -o bind /proc $CHROOTDIR/proc
    mount -o bind /dev $CHROOTDIR/dev
    mount -o bind /var/udev/mount/NASusbsda $CHROOTDIR/mnt/NASusbsda
  8. Make a “boot” script to set right variables inside chroot
    vi $CHROOTDIR/root/startchroot
    (paste this inside)
    source /etc/profile
  9. Chroot!
    ./busybox-mips chroot $CHROOTDIR /root/startchroot

Known issues

key mapping
  • DEL - ONLY in bash it print a ~ without delete characters, however it works fine in vi
  • ENTER - ONLY in nano I can't confirm the filename when saving

Somethings works but for example reading log cause a system crash


SSH accepts commands but can't open a remote shell, so you can use direct commands in this way:

ssh root@Telsey "touch /tmp/thisworks"

or use rsync. This issue is related with the kernel that miss /dev/pts filesystem (and can't be fixed using a module)

DNS and hosts

Be sure that your /etc/resolv.conf contains a working DNS server /etc/hosts is not read when a DNS resolution is in progress so you can't specify a particular ip for a name or use localhost instead of


  • Pegasus (usb-ethernet driver) kernel module - Available soon!
  • Alsa+USB Soundcards kernel modules - Available soon!
QR Code
QR Code Telsey CPVA642XF (generated for current page)