Home / Notes / Router Password Recovery
NOTES · ROUTER ACCESS / PASSWORD RECOVERY

Router Password Recovery: Console, Telnet and BootROM Methods Compared

Console password gone, Telnet password gone, or both — the fix depends entirely on which access you still have left, not on which password you actually forgot. This is the decision tree: what still works, which of the three recovery paths that puts you on, the exact steps for each, and the three things you must do the moment you're back in.

By the AtlasCommTech engineering team — 13 years of carrier & enterprise network deployments · Updated July 2026

Which Access Still Works Decides the Method — Not Which Password You Lost

All three recovery paths end at the same place — a fresh password and a saved configuration — but they start from completely different assumptions about what you can still reach.

Losing a router's Console password, Telnet password, or BootROM password is routine enough that Huawei documents an official recovery method for each — but the methods aren't interchangeable, and picking the wrong one first costs a service-affecting reboot for nothing. The question that actually decides which method to use isn't "which password did I lose" — it's "what can I still log in with right now."

What follows is the decision tree this is built on, the complete steps for each of the three official recovery paths — including exactly how to get into BootROM and clear the password there — the three things to do the instant you're back in, and the risks specific to the BootROM-level methods.

Start With What Still Works, Not With What You Lost

Two yes/no questions place you on one of three paths before you touch a single configuration line.

If Console is still reachable, you almost never need BootROM at all — that's the fastest and lowest-risk path by a wide margin. BootROM is the fallback for when both Console and Telnet are gone, and it's the one path that requires a service-affecting reboot.

Locked Out — What Still Works? Console Access Lost Console Access Still Works Q · Telnet still works, account privilege ≥ 15?check with display users / display user-interface YES → Path 1: reset Console password via Telnetno reboot, no BootROM needed at all NO, Console auth = password → BootROM Method 2skip console password at startup, service-affecting reboot NO, Console auth = AAA → BootROM Method 3rename startup config file, empty-config reboot + FTP restore Path 2 → reset Telnet / VTY password from ConsoleAAA mode or password mode, no reboot Separate case → recover a lost BootROM passwordrestore boot-password, needs CLI access, no BootROM entry needed yet

Diagram labels are kept in English for engineering clarity.

The one method that recovers a lost BootROM password itself is different again — it assumes you still have some form of command-line access to run the reset command from, which is why it sits outside this yes/no tree as its own case.

The Three Paths, Step by Step

Same end state — a working login and a saved configuration — reached through three very different procedures.

Path 1 — Console Password Lost, Telnet Still Works

This is the path to prefer whenever it's available — no reboot, no BootROM, no service interruption.

  1. Log in to the device over Telnet and confirm the account holds privilege level 3 or higher. Run display users to see all current login sessions — the line marked with a "+" is your own session; note its VTY index.
  2. Run display user-interface to see the privilege level actually assigned to that VTY line. The example below shows VTY 1 at level 15 — high enough to modify the Console line's authentication.
  3. Enter the Console user-interface and set a new password. The exact syntax differs by VRP version: V200R003C01 and earlier accept the cipher password inline; V200R005C00 and later prompt for it interactively.
  4. Save the configuration immediately — an unsaved password change is lost on the next reboot.
<Huawei> display users
 User-Intf  Delay     Type  Network Address    AuthenStatus   AuthorcmdFlag
  129 VTY 0  00:23:36  TEL   10.135.18.67       pass
   Username : Unspecified
+ 130 VTY 1  01:20:36  TEL   10.135.18.91       pass
   Username : Unspecified
  131 VTY 2  00:00:00  TEL   10.135.18.54       pass
   Username : Unspecified

<Huawei> display user-interface
   Idx   Type  Tx/Rx  Modem  Privi  ActualPrivi  Auth  Int
   0     CON 0 9600    -     15     -            P     -
+  129   VTY 0        -     15     15           P     -
+  130   VTY 1        -     15     15           P     -
+  131   VTY 2        -     15     -            P     -
   132   VTY 3        -     15     15           P     -
// VTY 1 is level 15 -- high enough to modify the Console line

# V200R003C01 and earlier
<Huawei> system-view
[Huawei] user-interface console 0
[Huawei-ui-console0] authentication-mode password
[Huawei-ui-console0] set authentication password cipher YsHsjx_202206
[Huawei-ui-console0] return

# V200R005C00 and later
<Huawei> system-view
[Huawei] user-interface console 0
[Huawei-ui-console0] authentication-mode password
[Huawei-ui-console0] set authentication password cipher
Enter Password(<8-128>):
[Huawei-ui-console0] return

<Huawei> save
 Warning: The current configuration will be written to the device.
 Are you sure to continue? (y/n)[n]:y
 It will take several minutes to save configuration file, please wait.........
 Configuration file had been saved successfully
 Note: The configuration file will take effect after being activated

Path 2 — Telnet Password Lost, Console Still Works

Two authentication modes, two different fixes — check which one is actually configured before choosing.

  1. From the Console session, check the current authentication mode for the VTY lines with display current-configuration configuration user-interface.
  2. If VTY authentication is AAA-based (username + password), create or reset a local user with Telnet service type and the privilege level it needs.
  3. If VTY authentication is password-only, set a new shared password directly on the VTY lines instead — the syntax again differs by VRP version.
  4. Save the configuration.

AAA authentication mode:

<Huawei> system-view
[Huawei] user-interface vty 0
[Huawei-ui-vty0] protocol inbound telnet
[Huawei-ui-vty0] authentication-mode aaa
[Huawei-ui-vty0] quit
[Huawei] aaa
[Huawei-aaa] local-user admin123 password irreversible-cipher YsHsjx_202206
[Huawei-aaa] local-user admin123 service-type telnet
[Huawei-aaa] local-user admin123 privilege level 15
[Huawei-aaa] return
<Huawei> save
// login afterwards: username admin123, password YsHsjx_202206

Password-only authentication mode:

# V200R003C01 and earlier
<Huawei> system-view
[Huawei] user-interface vty 0 4
[Huawei-ui-vty0-4] authentication-mode password
[Huawei-ui-vty0-4] set authentication password cipher YsHsjx_202207
[Huawei-ui-vty0-4] return

# V200R005C00 and later
<Huawei> system-view
[Huawei] user-interface vty 0
[Huawei-ui-vty0] authentication-mode password
[Huawei-ui-vty0] set authentication password cipher
Warning: The "password" authentication mode is not secure, and it is strongly recommended to use "aaa" authentication mode.
Enter Password(<8-128>):
Confirm password:
[Huawei-ui-vty0] user privilege level 15
[Huawei-ui-vty0] return
<Huawei> save
// login afterwards with password YsHsjx_202207 only, no username

Path 3 — Neither Console Nor Telnet Works: Into BootROM

The only path that needs a reboot — plan for a service interruption before you start.

Read Before You Reboot Into BootROM
  • Entering the BootROM menu requires a device reboot, which interrupts service — schedule this for a low-traffic window and back up the configuration first if at all possible.
  • Method 2 (skip Console password): the moment you're logged in with no password prompt, set a new password immediately — if the session times out or the device reboots again before you do, you're back to needing the skip method a second time.
  • Method 3 (rename the startup config file): the device boots with a genuinely empty configuration, not just a blank password — every interface, route and service is gone until you FTP the edited file back and set it as the startup configuration.
  • Do not power off the device at any point during either BootROM procedure.
  1. Connect a serial cable to the Console port and reboot the device. When "Press Ctrl+B to break auto startup ..." appears, press Ctrl+B and enter the BootROM password to reach the Main Menu.

Method 2 — Skip the Console Password at Startup (Console authentication-mode = password)

  1. From the BootROM Main Menu, choose 7. Password Manager, then 2. Clear the console login password.
  2. Return to the Main Menu and choose 1. Default Startup to boot the device.
  3. Log in over Console with no password prompt, then immediately set a new Console password using the same commands as Path 1, and save.
Main Menu
 1. Default Startup   2. Serial Menu   3. Network Menu   4. Startup Select
 5. File Manager      6. Reboot        7. Password Manager
Enter your choice(1-7):7
     PassWord Menu
 1. Modify the menu password   2. Clear the console login password   0. Return
Enter your choice(0-2):2
Clear the console login password Succeed!
     PassWord Menu
 1. Modify the menu password   2. Clear the console login password   0. Return
Enter your choice(0-2):0
     Main Menu
 1. Default Startup   2. Serial Menu   3. Network Menu   4. Startup Select
 5. File Manager      6. Reboot        7. Password Manager
Enter your choice(1-7):1
// device boots; Console now logs in with no password prompt at all

# after login, set a new password immediately (same syntax as Path 1)
<Huawei> system-view
[Huawei] user-interface console 0
[Huawei-ui-console0] authentication-mode password
[Huawei-ui-console0] set authentication password cipher YsHsjx_202206
[Huawei-ui-console0] return
<Huawei> save

Method 3 — Rename the Startup Config File (Console authentication-mode = AAA)

  1. From the BootROM Main Menu, choose 4. Startup Select, then 1. Display Startup to read off the current Boot File Name and Config File Name (for example flash:/cfgnew.zip).
  2. Choose 5. File Manager → 1. Flash file system → 3. Rename file in Flash, and rename that exact configuration file — for example cfgnew.zip to cfgnew-copy.zip.
  3. Return to the Main Menu and choose 1. Default Startup. Because its configuration file is now missing, the device boots with a genuinely empty configuration and prompts you to set a new Console login password on the spot.
  4. Configure the device as an FTP server (ftp server enable, a local FTP user with privilege level 15) so you can retrieve the renamed configuration file from a PC.
  5. FTP in from the PC, get the renamed file, unzip it, delete the Console authentication lines with a plain text editor, and re-zip it.
  6. FTP the edited file back to the device (put), then set it as the next startup configuration with startup saved-configuration and reboot fast — do not save the empty running configuration over it first.
  7. After this second reboot, set the Console password again when prompted, then save.
Main Menu
Enter your choice(1-7):4
     Startup Select
 1. Display Startup   2. Set Boot File   3. Set Config File
 4. Startupfile Check Manage   5. Set Startup Waiting Time   0. return
Enter your choice(0-5):1
************** Current Stratup info ****************
Boot File Name    : flash:/softwarenew.cc
Config File Name  : flash:/cfgnew.zip
     Startup Select
Enter your choice(0-5):0
     Main Menu
Enter your choice(1-7):5
     File Menu
 1. Flash file system   0. Return
Enter your choice(0-1):1
     SDCard file system MENU
 1. List file in Flash   2. Delete file in Flash   3. Rename file in Flash
 4. Format Flash        5. Check Flash            0. Return
Enter your choice(0-5):3
Please input the file name: cfgnew.zip
Please input the new name: cfgnew-copy.zip
Rename file[flash:/cfgnew.zip] to [flash:/cfgnew-copy.zip], Yes or No(Y/N): y
Rename OK!
     SDCard file system MENU
Enter your choice(0-5):0
     File Menu
Enter your choice(0-1):1
     Main Menu
Enter your choice(1-7):1
// device reboots with an empty configuration and prompts:
Please configure the login password (<8-128>)
Enter password:
Confirm password:
<Huawei> system-view
[Huawei] ftp server enable
Info: Succeeded in starting the FTP server.
[Huawei] aaa
[Huawei-aaa] local-user huawei password irreversible-cipher YsHsjx_202206
[Huawei-aaa] local-user huawei ftp-directory flash:
[Huawei-aaa] local-user huawei service-type ftp
[Huawei-aaa] local-user huawei privilege level 15

C:\Documents and Setting\Administrator> ftp 10.110.24.254
User (10.110.24.254:(none)): huawei
331 Password required for huawei.
Password:
230 User logged in.
ftp> get cfgnew-copy.zip
226 Transfer complete.
// unzip on the PC, delete the Console authentication lines with a text editor, re-zip

ftp> put cfgnew-copy.zip
226 Transfer complete.

<Huawei> startup saved-configuration cfgnew-copy.zip
Info: Succeeded in setting the file for booting system
<Huawei> reboot fast
System will reboot! Continue ? [y/n]:y
// device reboots a second time and prompts again:
Please configure the login password (<8-128>)
Enter password:
Confirm password:
<Huawei> save

Recovering a Lost BootROM Password Itself

This is a different case again — it assumes you still have command-line access, just not the BootROM menu password.

  1. From the device CLI, restore the default BootROM password: system-view → diagnose → restore boot-password, then reboot.
  2. After the reboot banner appears, press Ctrl+B and enter the (now default) BootROM password to reach the Main Menu.
  3. Choose 7. Password Manager → 1. Modify the menu password, enter the old (default) password once and the new password twice to confirm.
<Huawei> system-view
[Huawei] diagnose
[Huawei-diagnose] restore boot-password
Info: Restore boot password success!
[Huawei-diagnose] return
<Huawei> reboot
System will reboot! Continue ? [y/n]:y
// after the reboot banner, press Ctrl+B and enter the (now default) BootROM password
     Main Menu
Enter your choice(1-7):7
     PassWord Menu
 1. Modify the menu password   2. Clear the console login password   0. Return
Enter your choice(0-2):1
Modify password. Press Ctrl+c to break.
Enter Old Password:******
Input new password:******
Input new password again:******
Are you sure to change password? [y/n]:y
Save new password Success.

Recovery Isn't Done Until You've Done These Three Things

The password reset is the easy part — skipping any of these three turns today's recovery into next week's repeat.

  1. Set the new password immediately, before doing anything else — this matters most right after Method 2's skip-password boot, where the device is briefly wide open.
  2. Save the configuration with save every time — an unsaved change disappears on the next reboot, and you're straight back into the same recovery procedure.
  3. Record the new password somewhere your team can actually retrieve it, and — since Huawei's official default account/password reference for AR routers requires elevated document access — confirm who on the team can pull that reference the next time this happens, before it happens again.

Five Things That Trip Up an Otherwise Textbook Recovery

Once you're on the right path, these are the details that actually cause the retries.

Method 1 Needs a High Enough Privilege Level, Not Just a Valid Telnet Login

SYMPTOMYou're logged in over Telnet just fine, but the Console authentication commands aren't accepted or don't seem to apply.

CAUSEdisplay users only confirms a session exists; the actual permission to touch the Console line's authentication comes from the privilege level shown against that VTY line in display user-interface. A valid Telnet login at a lower level can't make this change.

FIXRun display user-interface before attempting the change and confirm the VTY line sits at level 15 (or whatever level your local policy requires for line configuration) before touching the Console authentication-mode.

<Huawei> display user-interface
+  130   VTY 1   -   15   15   P   -
// ActualPrivi must be high enough to modify user-interface console 0

BootROM Only Answers on a Physical Serial Cable, Never Over Telnet or SSH

SYMPTOMCtrl+B produces nothing, or the BootROM menu never appears, even though the reboot clearly happened.

CAUSEThe BootROM prompt exists before the operating system — and therefore before Telnet or SSH — has loaded at all. It is only ever reachable through a serial cable physically connected to the Console port, with a terminal program watching that session through the reboot.

FIXConnect a serial cable to Console before rebooting, not after, and keep the terminal session open and watching through the entire reboot so the "Press Ctrl+B" window isn't missed.

Skip-Console-Password Leaves the Device Open Until You Close It Yourself

SYMPTOMYou get back in easily after Method 2, but the device is sitting there with no Console password at all.

CAUSEClearing the console login password in BootROM removes the authentication requirement outright — it doesn't set a temporary password, it removes the check. That state persists until you configure a new password and save it.

FIXSet the new password in the very same session you used to get back in, before doing anything else, and save immediately — don't leave this for later in the same maintenance window.

The Cipher-Password Syntax Isn't the Same Across VRP Versions

SYMPTOMThe exact command from a different firmware version's documentation gets rejected, or the device behaves as if the password was never actually set.

CAUSEV200R003C01 and earlier accept set authentication password cipher followed directly by the plaintext password on the same line. V200R005C00 and later instead prompt interactively for Enter Password(<8-128>) — the same conceptual command, incompatible syntax.

FIXCheck the running version first, and use the matching form from the two shown in Path 1 and Path 2 above rather than assuming one syntax works everywhere.

# V200R003C01 and earlier
[Huawei-ui-console0] set authentication password cipher YsHsjx_202206

# V200R005C00 and later
[Huawei-ui-console0] set authentication password cipher
Enter Password(<8-128>):

Method 3 Erases the Whole Configuration, Not Just the Password

SYMPTOMAfter the BootROM reboot in Method 3, nothing works — not just the login, the interfaces, routes and services all look gone too.

CAUSERenaming the active startup configuration file doesn't touch the password specifically — it makes the file the device looks for at boot disappear, so the device starts from a genuinely empty configuration. The original configuration still exists on flash under its new name; it hasn't been deleted, just temporarily set aside.

FIXThis is exactly why the FTP-retrieve, edit, and restore steps in Method 3 aren't optional — the device isn't fully recovered until the edited configuration file is uploaded back and set as the startup configuration. Whenever the Console authentication mode allows it, prefer Method 2 over Method 3 for this reason: it never touches the rest of the configuration.

Related solution designs

Enterprise Campus Network Solution: Wired + Wi-Fi That Just Works — Offices, Hotels, SchoolsThe campus network these routers typically sit at the edge of — where a lost password on the wrong device becomes an all-hands outage. Multi-Branch VPN Interconnection Solution: Every Store and Site on One NetworkMultiply this same router across every branch, and a documented, low-risk password-recovery procedure stops being optional.

Five Questions That Come Up Constantly

Pulled straight from the field — the ones worth having an answer ready for.

Which of the three methods should I actually try first?

Always Method 1 if Telnet still works — it needs no reboot and no BootROM at all. If Telnet is also gone, go to BootROM: Method 2 first whenever Console authentication is password mode, since it never touches the rest of the configuration; Method 3 when Console authentication is AAA mode, or as the fallback if Method 2 doesn't fit your case.

Does going into BootROM affect production traffic?

Yes — reaching the BootROM menu requires rebooting the device, and that reboot interrupts whatever traffic the device is carrying. Both BootROM methods share this cost; there's no way to reach the BootROM menu without it.

What happens if power is lost partway through the BootROM procedure?

The official guidance is direct: don't power the device off at any point during either BootROM procedure. Flash and configuration operations mid-write can leave the device in an inconsistent state, which is exactly why this is treated as a hard rule rather than a suggestion, not something to test.

I got into the BootROM menu, but I don't actually know the BootROM password either — now what?

That's the separate case covered above: recovering the BootROM password itself starts from restore boot-password, which has to be run from the device's own command line — meaning it only works if you still have some CLI access at all, through Console or Telnet. If every login path is gone at once, that's a different, more serious situation than a lost password — see our note on emergency recovery when Telnet, SSH and Console all fail.

Where do I find the actual default account and password for a specific AR model?

Huawei publishes an official "AR Router Default Accounts and Passwords" reference covering both enterprise and carrier scenarios, but pulling it requires elevated document-access permission on Huawei's support site. Worth confirming in advance who on your team can retrieve it, rather than discovering the access gap during an actual recovery.

Honest Limits of This Note

Honest Limits of This Note

This note follows the official Huawei AR-series recovery procedures for Console, Telnet and BootROM passwords, reproduced here exactly as documented. The cipher values shown (like YsHsjx_202206) are the example values from that documentation, not real credentials. It assumes VRP-based AR routers specifically — the menu structure and command syntax will differ on other platforms — and it doesn't cover the case where Console, Telnet and every other management path are unavailable at the same time; that's a different problem, covered in our companion note on emergency login recovery.

Not sure which recovery path applies to your box?

Tell us what you can still log in with — Console, Telnet, neither — and we'll help you pick the right path before you reboot into anything.

WhatsApp an engineer →

Related Reading

Locked Out of Your Router: Emergency Recovery When Telnet, SSH and Console All FailWhat to do when it's not a forgotten password — none of the three methods above even get you a login prompt. IPSec VPN Tunnel Won't Come Up? A Troubleshooting Flowchart and the Usual Root CausesDifferent fault, same discipline — work the stages in order before changing configuration on either end. OSPF Neighbor Stuck or Route Flapping?Another read-the-state-first troubleshooting note for the same class of router.