I've purchased my VMG3625-T50B, which is pretty similar to VMG8623-T50B, from a local ISP (te-data) and I guess they worked really hard to make sure no one gets to debrand the device. I got the supervisor password, which is the same as root, from the generator and by using a ping command injection script you can find here, I gained root shell access to the router and these are the steps:

1. Get the supervisor/root password
2. Connect to the router via LAN
3. On a Linux machine, open a terminal and run nc -nvlp 13373
4. In a new terminal, run python3 cmd_injection_ping2.py

Voila! Now I have root shell access.

By executing zycli sys atsh I get the following:

Firmware Version        : V550ABTL0b2r
Bootbase Version        : V1.41 | 12/08/2020 15:47:56
Vendor Name             : Zyxel Communications Corp.
Product Model           : VMG3625-T50B
Serial Number           : S213Hxxxxxxxxx
First MAC Address       : xxxxxxxxxxxx
Last MAC Address        : xxxxxxxxxxxx
MAC Address Quantity    : 16
Default Country Code    : FF
Boot Module Debug Flag  : 00
Kernel Checksum         : E993EF2A
RootFS Checksum         : 1DB70D37
Romfile Checksum        : 0000BC11
Main Feature Bits       : 00
Other Feature Bits      : 
7f93cc45: 04050503 00000100 00000000 00000000
7f93cc55: 00000000 00000000 00000000 0000

and netstat produces:

Active Internet connections (w/o servers)
Proto   Recv-Q  Send-Q   Local Address            Foreign Address         State       
tcp          0       0   192.168.1.1:[port]       192.168.1.12:13373      ESTABLISHED
...
...

My problem is I don't know how to successfully copy the bootloader file as I'm no expert in any of this. Performing regular ssh or ftp commands from my machine results in failure because these protocols are somehow blocked and hidden.

I thought of modifying the mentioned script to inject an scp command but I don't know how the script fully works and when I tried to do stuff on my own I failed and almost broke my device. 😃

Any thoughts? I'd really appreciate it.