CFE

CFE (Common Firmware Environment) is a bootloader exclusively for Broadcom chips.

CFE is a bootloader developed by Broadcom for its chips.

Features:

1. Exclusive to Broadcom chips
2. Closed source
3. Serial console command operation
4. Supports network boot
5. Common in some Netgear and ASUS models

1. BCM47xx: 802.11n era
2. BCM53xx: 802.11ac era
3. BCM675xx: WiFi 6 era
4. BCM6756/BCM6765: WiFi 7 era

1. Connect TTL serial (115200 baud)
2. Power off the router
3. Hold C + Enter or Space bar
4. Power on the router
5. Wait until the CFE> prompt appears

Some models support entering via Wake-on-LAN:

1. telnet 192.168.1.1
2. Enter username and password
3. Enter command to enter CFE mode

# View help
help

# View system info
show devices
show chips

# View environment variables
show env

# Set environment variables
setenv nvram key value
commit

# Boot from Flash
boot

# Boot from TFTP network
flash -ctheader : flash0 boot

# Set IP
setenv ipaddr 192.168.1.1
setenv netmask 255.255.255.0
setenv gatewayip 192.168.1.254

# TFTP load firmware
flash -ctheader 192.168.1.100:firmware.chk flash0

# View NVRAM
nvram show

# Set NVRAM
nvram set lan_ipaddr=192.168.1.1
nvram commit

# Clear NVRAM
nvram erase
reboot

1. Install TFTP server
2. Place .chk firmware in TFTP directory
3. Use ethernet cable to directly connect to router LAN port
4. Set computer IP to 192.168.1.x

# At CFE> prompt

# Set boot parameters
setenv ipaddr 192.168.1.1
setenv netmask 255.255.255.0
setenv gatewayip 192.168.1.254
setenv serverip 192.168.1.100

# Flash firmware
flash -ctheader 192.168.1.100:firmware.chk flash0

# Reboot
reboot

1. Use .chk file (not .bin)
2. Wait for flashing to complete, do not power off
3. Flashing takes about 3-5 minutes

1. Cannot save settings
2. Settings reset after reboot
3. WiFi name/password lost

# In CFE
nvram erase
reboot

# Or in Web recovery mode
# Factory reset

# Via Telnet/SSH
telnet 192.168.1.1
# Username: admin
# Password: admin

# Backup NVRAM
dd if=/dev/mtd/0 of=/tmp/nvram.bin
# Export via SCP/SFTP

1. Confirm serial parameters are correct (115200 8N1)
2. Try different key combinations (C/Enter/Space)
3. Serial tool may need to be opened first

1. Confirm using .chk file
2. Check network connection
3. Confirm TFTP server is reachable
4. Try a different TFTP client

1. CFE NVRAM is different from others
2. Factory reset and reconfigure
3. Some models need to reset region code

Different CFE versions have slightly different commands:

1. Enter help to view available commands
2. Some commands require uppercase
3. Refer to the corresponding model's tutorial

Netgear recommends using nmrpflash for flashing:

# Linux/macOS
sudo nmrpflash -i eth0 -f firmware.chk 192.168.1.1

# Windows
nmrpflash.exe -i Ethernet -f firmware.chk 192.168.1.1

1. Power off the router
2. Hold Restore Factory Settings button
3. Insert power cable
4. Wait for all lights to light up simultaneously
5. Access 192.168.1.1

1. Breed
2. U-Boot
3. TFTP Recovery
4. NMRP Recovery