The 2nd floor needed an additional wifi access point, and so I purchased a used Zyxel NWA90AX for 60€ on kleinanzeigen.de.
Before buying I checked that it is supported by OpenWrt and found that NWA90AX Pro is supported, but it uses a totally different chipset. The NWA50AX is also supported and has the same hardware as the NWA90AX:
NWA90AX: Identical hardware as in NWA50AX, but with added features like Captive portal for Guest access and WPA Enterprise for AD/Radius (Credential) authentication.
I followed the NWA50AX instructions (especially flashing the vendor firmware to get the Current Image to 1), but then flashing failed with:
errno: -25007
errmsg: Firmware content error!
I immediately suspected that the firmware contains a list of compatible models, but needed 5 days and many detours to - accidentially - find the model code 77 e1 of the NWA90AX.
Now the access point provides beautiful 5 + 2.4 GHz wireless lan with the latest OpenWrt firmware. The patch that adds support is awaiting review.
Accidental discovery
I downloaded every available NWA50AX and NWA90AX firmware to check which 50 version I can flash over the same 90 version.
| Version | NWA50AX | NWA90AX |
|---|---|---|
| 6.25(8) | NWA50AX_6.25(ABYW.8)C0.zip | |
| 6.27(2) | - | NWA90AX_6.27(ACCV.2)C0.zip |
| 6.29(3) | NWA50AX_6.29(ABYW.3)C0.zip | NWA90AX_6.29(ACCV.3)C0.zip |
| 6.29(4) | NWA50AX_6.29(ABYW.4)C0.zip | NWA90AX_6.29(ACCV.4)C0.zip |
| 7.00(1) | - | NWA90AX_7.00(ACCV.1)C0.zip |
| 7.00(2) | NWA50AX_7.00(ABYW.2)C0.zip | NWA90AX_7.00(ACCV.2)C0.zip |
| 7.10(1) | - | NWA90AX_7.10(ACCV.1)C0.zip |
| 7.10(3) | NWA50AX_7.10(ABYW.3)C0.zip | NWA90AX_7.10(ACCV.3)C0.zip |
Only the latest V7.10(3) was the one whose 50 version I could flash onto my 90 hardware.
While installing the firmware versions, I had the browser developer console's network tab open and saw the following:
## Checking hash(es) for FIT Image at 752a9000 ...
Hash(es) for Image 0 (script): sha256+
Hash(es) for Image 1 (Bootloader): sha256+
Hash(es) for Image 2 (firmware): sha256+
Hash(es) for Image 3 (rootfs_data): sha256+
Hash(es) for Image 4 (logs): sha256+
Hash(es) for Image 5 (myzyxel): sha256+
Hash(es) for Image 6 (bootconfig): sha256+
Hash(es) for Image 7 (mrd): sha256+
Content-Type: text/html
<html><head></head><body>
var zyshdata0=[{'_model':'NWA90AX','_firmware_version':'V6.29(ACCV.4)','_build_date':'2024-01-10 14:37:56'}];
var errno0=0;
var errmsg0='OK';
</body></html>
Upgrade started
Current time: Sat Sep 27 15:54:56 DGMT 2025
----- kernel cmdline -----
console=ttyS0,115200 loglevel=1 bootImage=1 bootVer=V1.03 rootfstype=squashfs,jffs2
------- FW version -------
FIRMWARE_VER=6.29(ACCV.4)
BUILD_DATE=2024-01-10 14:37:56
MODEL_ID=NWA90AX
COMPATIBLE_PRODUCT_MODEL_0=77E1
COMPATIBLE_PRODUCT_MODEL_1=FFFF
COMPATIBLE_PRODUCT_MODEL_2=FFFF
COMPATIBLE_PRODUCT_MODEL_3=FFFF
COMPATIBLE_PRODUCT_MODEL_4=FFFF
I don't know if that was a bug in this specific firmware, but the upgrade log was sent to the browser - not only the part within the <html>. But this was where I found the NWA90AX's model code.