# CWMP ### Overview **CWMP** (CPE WAN Management Protocol), commonly known by its Broadband Forum specification number **TR-069**, is a bidirectional **SOAP-over-HTTP** application-layer protocol for remote management of customer-premises equipment (CPE). It runs over **TCP**, on the IANA-assigned port **7547**, and follows a client-server model between the managed CPE (routers, cable/DSL modems, VoIP ATAs, and increasingly cameras and other IoT devices) and an ISP-operated Auto Configuration Server (ACS), which uses it to provision configuration, push firmware updates, and run remote diagnostics without a truck roll. The CPE-initiated `Inform` RPC — sent in a SOAP envelope under the XML namespace `urn:dslforum-org:cwmp-1-x` (version-dependent) — carries a `DeviceId` structure with **Manufacturer**, **OUI**, **ProductClass**, and **SerialNumber** fields in cleartext XML, making it a direct device fingerprint whenever the exchange isn't wrapped in TLS. The ACS can also issue an unsolicited **Connection Request** back to the CPE on port 7547 (typically HTTP Basic/Digest authenticated) to trigger an immediate session. CWMP traffic is plaintext HTTP by default unless the HTTPS variant is negotiated, and internet-exposed port 7547 endpoints have been a recurring target for CPE-hijacking botnets (e.g., the 2016 Mirai/Annie attacks). ### Protocol Stacks ``` ------------------------------------ Customer Premises Equipment | CPE/ACS Management Application | <= Auto Configuration Server |------------------------------------| | PRC method | <= Remote Procedure Call |------------------------------------| | SOAP | |------------------------------------| | HTTP | |------------------------------------| | SSL/TLS | |------------------------------------| | TCP/IP | ------------------------------------ ``` ### Baseline RPC Messages tr-069-1-6-1.pdf#page=83&zoom=100,117,494 Generic Methods Description GetRPCMethods Discover the set of methods. CPE Methods (ACS → CPE) Description SetParameterValues Modify the value of one or more CPE Parameters. GetParameterValues Obtain the value of one or more CPE Parameters. GetParameterNames Discover the Parameters accessible on a particular CPE. SetParameterAttributes Modify attributes associated with one or more CPE Parameter. GetParameterAttributes Read the attributes associated with one or more CPE Parameter. AddObject Create a new instance of a Multi-Instance Object. DeleteObject Remove a particular instance of an Object. Download Cause the CPE to download a specified file from the designated location. Reboot Causes the CPE to reboot. ACS Methods (CPE → ACS) Description Inform CPE MUST call the Inform method to initiate a transaction sequence whenever a Session with an ACS is established. TransferComplete Informs the ACS of the completion (either successful or unsuccessful) of a file transfer initiated by an earlier Download, ScheduleDownload or Upload method call. AutonomousTransferComplete Informs the ACS of the completion (either successful or unsuccessful) of a file transfer that was not specifically requested by the ACS. ### Inform tr-069-1-6-1.pdf#page=107&zoom=100,117,406 Argument Type Value DeviceId DeviceIdStruct Uniquely identifies the CPE. Event EventStruct[64] Event. MaxEnvelopes unsignedInt Set to a value of 1. CurrentTime dateTime CPE current date and time. RetryCount unsignedInt Number of prior times an attempt was made to retry this Session. ParameterList ParameterValueStruct[] Name-value pairs. ### DeviceIdStruct tr-069-1-6-1.pdf#page=109&zoom=100,117,96 Name Type Description Manufacturer string(64) Manufacturer of the device (for display only). The value MUST be the same as the value of the DeviceInfo.Manufacturer Parameter. OUI string(6) Same as the value of the DeviceInfo.ManufacturerOUI Parameter. ProductClass string(64) Same as the value of the DeviceInfo.ProductClass Parameter. Often a strong indication for model name. SerialNumber string(64) Same as the value of the DeviceInfo.SerialNumber Parameter. ### EventCode tr-069-1-6-1.pdf#page=65&zoom=100,117,433 No. Event Code No. Event Code 0 BOOTSTRAP 8 DIAGNOSTICS COMPLETE 1 BOOT 9 REQUEST DOWNLOAD 2 PERIODIC 10 AUTONOMOUS TRANSFER COMPLETE 3 SCHEDULED 11 DU STATE CHANGE COMPLETE 4 VALUE CHANGE 12 AUTONOMOUS DU STATE CHANGE COMPLETE 5 KICKED 13 WAKEUP 6 CONNECTION REQUEST 14 HEARTBEAT 7 TRANSFER COMPLETE ### Sample Inform ```js title="CWMP Inform" :collapsed-lines=10 POST / HTTP/1.1 Authorization: Digest username="qacafe", realm="qacafe", uri="/", algorithm=MD5, nonce="XXXXXXXXXXXXXXXX", nc=00000001, cnonce="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", qop=auth, response="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", opaque="" Content-Length: 1833 Content-Type: text/xml Host: acs1.broadband-forum.org User-Agent: MikroTik MikroTik E48D8C hAP lite XXXXXXXXXXXX 8 DIAGNOSTICS COMPLETE 1 2018-04-01T19:45:02-04:00 0 Device.RootDataModelVersion 2.11 Device.DeviceInfo.SoftwareVersion 6.42rc49 Device.DeviceInfo.ProvisioningCode Device.DeviceInfo.HardwareVersion v1.0 Device.ManagementServer.ParameterKey cdrouter Device.ManagementServer.ConnectionRequestURL http://10.0.0.1:7547/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Device.ManagementServer.AliasBasedAddressing 0 ``` ### Reference [Huawei - eSight Third-Party Device Management Specifications (Communication Terminals)](https://support.huawei.com/enterprise/en/doc/EDOC1100266815/f18f44a/inform-message-format) [Broadband forum - CWMP Technical Report](https://www.broadband-forum.org/technical-library/?search=cwmp) [Broadband forum - TR-069 Technical Report](https://www.broadband-forum.org/technical-library/?number=TR-069) [IANA search=cwmp](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=cwmp) [Broadband Forum TR-069 CPE WAN Management Protocol](https://www.broadband-forum.org/technical/download/TR-069.pdf) [Cisco - CWMP_Technology_Commands.zip](https://github.com/ericwu1997/ericwu1997.github.io/raw/refs/heads/main/content/docs/app-layer-protocols/cwmp/CWMP_Technology_Commands.zip) [University of New Hampshire InterOperability Laboratory - TR-069_Crash_Course.zip](https://github.com/ericwu1997/ericwu1997.github.io/raw/refs/heads/main/content/docs/app-layer-protocols/cwmp/TR-069_Crash_Course.zip)