What is the AT entercnd password?

No this isn't it. Again, this is for the MR1100 Nighthawk, not the 77xS / 34xU

Hi,

I see from that reference it says the password is stored in NVRAM.

Could someone with a modem that has a known password, complete the following steps:

1. backup the NVRAM (xqcn format)

2A. AT!ENTERCND="oldpassword"

2B. AT!SETCND="password"

3. backup the NVRAM (xqcn format)

4. compare the xqcn files

5. identify the NV_Items EFS_Data stream that changed, e.g.

<Storage Name='EFS_Data'>
	  <Stream Name="00000001" Length="8" Value="04 00 00 00 00 00 00 00 "/>

 6. identify the NV_Items EFS_Dir that has the matching stream

<Storage Name='NV_Items'>
        <Storage Name='EFS_Dir'>
	  <Stream Name="00000001" Length="28" Value="2F 6E 76 2F 69 74 65 6D 5F 66 69 6C 65 73 2F 72 66 6E 76 2F 30 30 30 32 35 32 31 34 "/>

 7. Report back here the EFS_Data for both passwords, both passwords and the EFS_Dir.

Please note there will also be EFS_Dir and EFS_Data under EFS_Backup in the xml so don't mix them up.

Once we know the EFS_Dir and password encoding, we'll know where to look for users with modems that have unknown passwords.