CWMP | Documentation | IPS Work Notes

Overview

CWMP (CPE WAN Management Protocol), commonly known by its Broadband Forum specification number TR-069, is a bidirectional SOAP-over-HTTP application-layer protocol for remote management of customer-premises equipment (CPE). It runs over TCP, on the IANA-assigned port 7547, and follows a client-server model between the managed CPE (routers, cable/DSL modems, VoIP ATAs, and increasingly cameras and other IoT devices) and an ISP-operated Auto Configuration Server (ACS), which uses it to provision configuration, push firmware updates, and run remote diagnostics without a truck roll.

The CPE-initiated Inform RPC — sent in a SOAP envelope under the XML namespace urn:dslforum-org:cwmp-1-x (version-dependent) — carries a DeviceId structure with Manufacturer, OUI, ProductClass, and SerialNumber fields in cleartext XML, making it a direct device fingerprint whenever the exchange isn't wrapped in TLS. The ACS can also issue an unsolicited Connection Request back to the CPE on port 7547 (typically HTTP Basic/Digest authenticated) to trigger an immediate session. CWMP traffic is plaintext HTTP by default unless the HTTPS variant is negotiated, and internet-exposed port 7547 endpoints have been a recurring target for CPE-hijacking botnets (e.g., the 2016 Mirai/Annie attacks).

Protocol Stacks

 ------------------------------------     Customer Premises Equipment
|   CPE/ACS Management Application   | <= Auto Configuration Server
|------------------------------------|
|            PRC method              | <= Remote Procedure Call
|------------------------------------|
|               SOAP                 | 
|------------------------------------|
|               HTTP                 |
|------------------------------------|
|              SSL/TLS               | 
|------------------------------------|
|              TCP/IP                |
 ------------------------------------

Baseline RPC Messages

tr-069-1-6-1.pdf#page=83&zoom=100,117,494

Generic Methods	Description
`GetRPCMethods`	Discover the set of methods.

CPE Methods (ACS → CPE)	Description
`SetParameterValues`	Modify the value of one or more CPE Parameters.
`GetParameterValues`	Obtain the value of one or more CPE Parameters.
`GetParameterNames`	Discover the Parameters accessible on a particular CPE.
`SetParameterAttributes`	Modify attributes associated with one or more CPE Parameter.
`GetParameterAttributes`	Read the attributes associated with one or more CPE Parameter.
`AddObject`	Create a new instance of a Multi-Instance Object.
`DeleteObject`	Remove a particular instance of an Object.
`Download`	Cause the CPE to download a specified file from the designated location.
`Reboot`	Causes the CPE to reboot.

ACS Methods (CPE → ACS)	Description
`Inform`	CPE MUST call the Inform method to initiate a transaction sequence whenever a Session with an ACS is established.
`TransferComplete`	Informs the ACS of the completion (either successful or unsuccessful) of a file transfer initiated by an earlier Download, ScheduleDownload or Upload method call.
`AutonomousTransferComplete`	Informs the ACS of the completion (either successful or unsuccessful) of a file transfer that was not specifically requested by the ACS.

Inform

tr-069-1-6-1.pdf#page=107&zoom=100,117,406

Argument	Type	Value
`DeviceId`	`DeviceIdStruct`	Uniquely identifies the CPE.
`Event`	`EventStruct[64]`	Event.
`MaxEnvelopes`	`unsignedInt`	Set to a value of 1.
`CurrentTime`	`dateTime`	CPE current date and time.
`RetryCount`	`unsignedInt`	Number of prior times an attempt was made to retry this Session.
`ParameterList`	`ParameterValueStruct[]`	Name-value pairs.

DeviceIdStruct

tr-069-1-6-1.pdf#page=109&zoom=100,117,96

Name	Type	Description
`Manufacturer`	`string(64)`	Manufacturer of the device (for display only). The value MUST be the same as the value of the `DeviceInfo.Manufacturer` Parameter.
`OUI`	`string(6)`	Same as the value of the `DeviceInfo.ManufacturerOUI` Parameter.
`ProductClass`	`string(64)`	Same as the value of the `DeviceInfo.ProductClass` Parameter. Often a strong indication for model name.
`SerialNumber`	`string(64)`	Same as the value of the `DeviceInfo.SerialNumber` Parameter.

EventCode

tr-069-1-6-1.pdf#page=65&zoom=100,117,433

No.	Event Code	No.	Event Code
0	`BOOTSTRAP`	8	`DIAGNOSTICS COMPLETE`
1	`BOOT`	9	`REQUEST DOWNLOAD`
2	`PERIODIC`	10	`AUTONOMOUS TRANSFER COMPLETE`
3	`SCHEDULED`	11	`DU STATE CHANGE COMPLETE`
4	`VALUE CHANGE`	12	`AUTONOMOUS DU STATE CHANGE COMPLETE`
5	`KICKED`	13	`WAKEUP`
6	`CONNECTION REQUEST`	14	`HEARTBEAT`
7	`TRANSFER COMPLETE`

Sample Inform

CWMP Inform

POST / HTTP/1.1
Authorization: Digest username="qacafe", realm="qacafe", uri="/", algorithm=MD5, nonce="XXXXXXXXXXXXXXXX", nc=00000001, cnonce="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", qop=auth, response="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", opaque=""
Content-Length: 1833
Content-Type: text/xml
Host: acs1.broadband-forum.org
User-Agent: MikroTik

<soapenv:Envelope
 xmlns:soap='http://schemas.xmlsoap.org/soap/encoding/'
 xmlns:xsd='http://www.w3.org/2001/XMLSchema'
 xmlns:cwmp='urn:dslforum-org:cwmp-1-0'
 xmlns:soapenv='http://schemas.xmlsoap.org/soap/envelope/'
 xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'>
 <soapenv:Body>
  <cwmp:Inform>
   <DeviceId>
    <Manufacturer>MikroTik</Manufacturer>
    <OUI>E48D8C</OUI>
    <ProductClass>hAP lite</ProductClass>
    <SerialNumber>XXXXXXXXXXXX</SerialNumber>
   </DeviceId>
   <Event soap:arrayType='cwmp:EventStruct[1]'>
    <EventStruct>
     <EventCode>8 DIAGNOSTICS COMPLETE</EventCode>
     <CommandKey></CommandKey>
    </EventStruct>
   </Event>
   <MaxEnvelopes>1</MaxEnvelopes>
   <CurrentTime>2018-04-01T19:45:02-04:00</CurrentTime>
   <RetryCount>0</RetryCount>
   <ParameterList soap:arrayType='cwmp:ParameterValueStruct[7]'>
    <ParameterValueStruct>
     <Name>Device.RootDataModelVersion</Name>
     <Value xsi:type='xsd:string'>2.11</Value>
    </ParameterValueStruct>
    <ParameterValueStruct>
     <Name>Device.DeviceInfo.SoftwareVersion</Name>
     <Value xsi:type='xsd:string'>6.42rc49</Value>
    </ParameterValueStruct>
    <ParameterValueStruct>
     <Name>Device.DeviceInfo.ProvisioningCode</Name>
     <Value xsi:type='xsd:string'></Value>
    </ParameterValueStruct>
    <ParameterValueStruct>
     <Name>Device.DeviceInfo.HardwareVersion</Name>
     <Value xsi:type='xsd:string'>v1.0</Value>
    </ParameterValueStruct>
    <ParameterValueStruct>
     <Name>Device.ManagementServer.ParameterKey</Name>
     <Value xsi:type='xsd:string'>cdrouter</Value>
    </ParameterValueStruct>
    <ParameterValueStruct>
     <Name>Device.ManagementServer.ConnectionRequestURL</Name>
     <Value xsi:type='xsd:string'>http://10.0.0.1:7547/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx</Value>
    </ParameterValueStruct>
    <ParameterValueStruct>
     <Name>Device.ManagementServer.AliasBasedAddressing</Name>
     <Value xsi:type='xsd:boolean'>0</Value>
    </ParameterValueStruct>
   </ParameterList>
  </cwmp:Inform>
 </soapenv:Body>
</soapenv:Envelope>

Reference

Huawei - eSight Third-Party Device Management Specifications (Communication Terminals)
Broadband forum - CWMP Technical Report
Broadband forum - TR-069 Technical Report
IANA search=cwmp
Broadband Forum TR-069 CPE WAN Management Protocol
Cisco - CWMP_Technology_Commands.zip
University of New Hampshire InterOperability Laboratory - TR-069_Crash_Course.zip