Airties WAV-281

This device is NOT RECOMMENDED for future use with OpenWrt due to low flash/ram.
DO NOT BUY DEVICES WITH 4MB FLASH / 32MB RAM if you intend to flash an up-to-date and secure OpenWrt version onto it! See 4/32 warning for details.

1) This device does not have sufficient resources (flash and/or RAM) to provide secure and reliable operation.
This means that even setting a password or changing simple network settings might not be possible any more, rendering the device effectively useless. See OpenWrt on 4/32 devices what you can do now.

2) OpenWrt support for this device has ended in 2022.
19.07.10 was the last official build for 4/32 devices.

Supported since r20402

FIXME Is this device also known as ARV452CPW or ARV452CQW or ARV4520PW? Please leave a comment with sources which help to answer this question. Thanks! --- tmomas 2020/09/10 10:26

Version/Model S/N OpenWrt Version Supported Model Specific Notes
v1 A All Works out of the box

NOTE: Anything not included in model specific notes, or where a short comment couldn't be included on the notes.

CPU Ram Flash Network USB Serial JTag
Infineon danube 32MB 4 MiB 4×1 1×2.0 Yes ?

The default proprietary bootloader only accepts signed images with a special header.

Accepted signatures are:

  • BRNARV452

Those images can be created by OpenWrt.

However the bootloader consumes quite lot's of space and there is an uboot port for this platform available.

I prepared a signed image ( which - once flashed and started - replaces the original bootloader with uboot and flashes an OpenWrt image.

Images (kernel+rootfs) created by OpenWrt can be run by the proprietary bootloader as well as uboot as the kernel takes care about the used environment and choose a respective partition layout.

Uboot has an webserver integrated which gets activated by pressing the “WLAN”-button during power-on. Over its web interface you can now easily flash your actual firmware image of choice.

In short - using mentioned image above:

  1. press RESET button on the back and power on device
  2. connect to
  3. upload image 'openwrt-lantiq-danube-ARV4520PW-BRNDANUBE-brnImage_signed_flash_uboot_and_combined' as 'Firmware'
  4. “Processing, please wait........” will be shown, wait till you get back to the flashing interface
  5. Press reboot / power cycle device
  6. it will boot into the freshly flashed firmware which is gonna a) replace the current bootloader with uboot and b) flashes an OpenWrt squashfs image on the device (LEDs will indicate current status in a fancy way)
  7. When LEDs (VoIP,Phone1,Phone2,ISDN) are not blinking anymore (but just glowing) the update process is finished
  8. Voila - should become alive again with a shiny luci webinterface!

The uboot port provides HTTP functionality for uploading Firmware images via your webbrowser. To connect to the bootloader via HTTP you require a direct Ethernet connection (no switch in between involved)!

If you want to upgrade using TFTP you follow these steps (as an alternative to the above install process.

If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.

LuCI Web Upgrade Process
  • Browse to LuCI Upgrade URL
  • Upload TRX file to LuCI
  • Wait for reboot
Terminal Upgrade Process
  • Login as root via SSH on
  • Use the following commands to upgrade.
cd /tmp/
wget http://
mtd write /tmp/0 linux && reboot
Architecture MIPS
Vendor Infineon
Bootloader ?
System-On-Chip Danube PSB 50702 E
CPU Speed 333 Mhz
Flash-Chip EON EN29LV302B
Flash size 4 MiB
Wireless RaLink 2561T + RT2527L
Ethernet Infineon ADM69961
Serial Yes
SLIC Infineon PEF 4268T
ISDN Infineon PSB 21150-F V1.4

Model Number


Photo of front


Photo of back

Note: This will void your warranty!

  • To remove the cover simply do a/b/c.
  • There are two screws holding the PCB to the bottom cover.

Main PCB

Photo of PCB

How to connect to Serial Port baudrate 115200 8N1 3,3V

|  6  7  8  9  10
|  1 (2)(3) 4 (5)
|    RX TX    GND 

Not needed, you can recover it via serial. See Restore Uboot

The default network configuration is:

Interface Name Description Default configuration
br-lan LAN & WiFi
vlan0 (eth0.0) LAN ports (1 to 4) None
vlan1 (eth0.1) WAN port DHCP
wl0 WiFi Disabled

Numbers 0-3 are Ports 1-4 as labeled on the unit, number 4 is the Internet (WAN) on the unit, 5 is the internal connection to the router itself. Don't be fooled: Port 1 on the unit is number 3 when configuring VLANs. vlan0 = eth0.0, vlan1 = eth0.1 and so on.

Port Switch port
Internet (WAN) 4
LAN 1 3
LAN 2 2
LAN 3 1
LAN 4 0

The analog phones (on the FXS and ISDN lines) are handled with the Infineon PEF 4268T SLIC DC/DC controller. Then it is possible to configure “Telefon 1(F)”, “Telefon 2(U)” and “Telefon 3(ISDN)”

Analog phones can be plugged on the TAE-Stecker and TAE-Buchsen phone socket on top of the device with the TAE-to-RJ11 adapters (details on the TAE-type sockets here : ISDN phone can be plugged on the ISDN phone socket.

If you forgot your password, broken one of the startup scripts, firewalled yourself or corrupted the JFFS2 partition, you can get back in by using OpenWrt's failsafe mode.

The failsafe mode is only available via the serial connection with OpenWrt 12.09 (Codename “Attitude Adjustment”).

Later versions might work but I did not test that, yet. There are 3 different buttons: “WPS”, “WLAN on/off” and “RESET” which might trigger the failsafe mode in the later versions. If you press and hold the reset button when you switch the device on, then the uboot bootloader will go into failsafe mode and will make web server available under (see below). If you want the OpenWrt failsafe mode (and not the uboot bootloader fail-safe mode) then you need to wait 4-5 seconds before you press and hold the reset button.

NOTE: The root file system in failsafe mode is the SquashFS partition mounted in readonly mode. To switch to the normal writable root file system run mount_root and make any changes. Run mount_root now.

  1. Forgot/lost your password and you like to set a new one


  1. Forgot the routers IP address

uci get network.lan.ipaddr

  1. You accidentally run 'ipkg upgrade' or filled up the flash by installing to big packages (clean the JFFS2 partition and start over)

mtd -r erase rootfs_data If you are done with failsafe mode power cycle the router and boot in normal mode.

If you bricked your uboot you can load a functional one via uart. For that you need to bridge r64 (top) and r80 (bottom) with some solder. After that the soc boots up in UART mode. You can verfy that you are in UART-Mode if after powering up the device it writes the follwoing on the serial:

ROM VER: 1.0.3
CFG 04

Now you can transfer your u-boot.asc through a serial connection:

cat u-boot.asc > /dev/ttyUSB0

There exist quite a few more Modes, that are accesible through briding empty pads as shown in this thread. But none other than default and UART-Mode seems to be usefull.


Purchase new blue LEDs from Radio Shack, and replace them with your existing ones.

flash map

    Area            Address      Length 
[0] Boot            0xB0000000     128K
[1] Configuration   0xB0020000     256K
[2] Web Image       0xB0060000    3648K
[3] Code Image      0xB0060000    3648K
[4] Boot Params     0xB03F0000      64K
[5] Flash Image     0xB0000000    4096K
This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2020/09/10 10:28
  • by tmomas