User Tools

Site Tools


T-Home Speedport W 303V

The T-Home Speedport W 303V is a IAD sold by T-Com with a ADSL2+ Annex B Modem, 11n Wifi and two FXS ports as well as a S0 bus connector.

There are 2 models of it, “Typ A” and “Typ B”, having completely different hardware. Click here for "Typ B".


Model OpenWrt Version Supported Model Specific Notes
Typ A not tested ? ?
Typ B trunk broadcom based

Note, that these two models are significantly different. You cannot use the same firmware image for both.

Typ A


SoC Infineon PSB 50702 E V1.3 DANUBE XWAY DANUBE + passive heatsink
target Lantiq
CPU MIPS 24KEc network processor 32-bit, 333 or 425 MHz
RAM Qimonde HYB25DC256160CE-6 32 MiB
Flash Macronix MX 29LV320CBTC-90G 4 MiB
Ethernet ICplus IP101A 10/100 Mbit/s
WLAN RaLink RT2860T a/b/g/n, 2 antennas, left & right
ISDN Infineon, UMEC …
Serial Port yes details below
JTAG not found although present according to SoC description
USB not found although present according to SoC description
preinstalled firmware ARV7525PW1-B-LF-23 V1.06.000 U25 MAIN 2969

Serial Port

  • internal, onboard
  • 3.3V TTL
  • 2×5 solder points
5 4 3 2 1
o o o o o
10 9 8 7 6
  • 115200 bps 8N1
  • No flow control

as found by byteeater on

Accessing brnboot console

  • during normal boot: press space 3x, enter first four letters of the default interface password (see back of router)
  • with reset key held: press space 3x, enter password QT
  • holding reset + wlan during boot seems to run the brnboot recovery

Flash Layout

    Area            Address      Length 
[0] Boot            0xB0000000     128K
[1] Configuration   0xB0020000     192K
[2] Image 0         0xB0050000    3712K
[3] Image 1         0xB0050000    3712K
[4] Boot Params     0xB03F0000      64K
[5] Flash Image     0xB0000000    4096K


bootloader brnboot
official firmware
firmware encryption LZMA based obfuscation, cracked by Andi_84 on


toh/t-com/spw303v.txt · Last modified: 2018/06/02 10:17 by tmomas