*Disclaimer* This guide is only intended for people who have purchased a router that was once owned by Nova. It is not intended to be used on routers leased from them while using Nova as an ISP.

I've read several posts here about Nova's policy of locking users out of the Netcomm NF18ACV router they supply with connections, but nothing further than that. A recent experience of mine necessitated me finding a solution, so I thought I would share, in case anyone ever needs to know.

I purchased a used NF18ACV, which had previously been supplied by Nova. I purchased it to use as a second access point in my garage, which I have only recently added network connectivity to. I wanted the router to be able to run the same firmware as I am running on my primary (internet-connected) router, as this provides functionality far superior to what the stock ISP-supplied routers do.

Upon receiving it, I promptly did a factory reset, only to find that the default username/password combo of 'admin/admin', despite being printed on the bottom of the router, did not work.

I use Nova myself as an ISP, so was already aware of their policy of locking customers out of their router. In fact, it was this decision that prompted me to buy my own NF18ACV earlier this year, so I didn't have to live with ringing them for the password any time I wanted to make changes to my network.

Despite a few attempts at guessing the password, I was not able to log on. So I phoned Nova. Eventually I was called by one of their support team who was able to help me. While they didn't have the initial default password on file, I was able to connect the router to the ONT and have it sync up with Nova, then download the latest config (and a known admin password). He then gave me the current admin password and I was able to log on.

When I've spoken to them about this in the past, they have always given me the password but added that at any point in the future, the password could change so I would need to call them again. This is because they use TR-069 to centrally manage routers on customer premises.

While on the phone with the Nova guy, I thought I would find out what might happen to my router in the future. Given I would be upgrading the firmware and removing the TR-069 entry to prevent it from finding its way back to Nova passwords in future, I wanted to make sure I wasn't setting myself up for a brick - a router with the unknown original password from Nova but no way of ever changing it. The guy I spoke to seemed to think it would be fine, but I was unconvinced. 

I then contacted Netcomm support to ask what would happen in this case. Here's a summary of what I've been able to establish, from my own experience and from Netcomm Support:

The custom admin password is contained in the Nova firmware image
The Nova firmware image also contains configuration to use their TR-069 server, providing them with the ability to rotate admin passwords on all willing routers
Even if you have admin access to the router, you cannot install a generic firmware image from Netcomm. BUT.....
You can upload a firmware image to the router using TFTP without any authentication. This will do two things
Put a generic firmware image onto your router
Reset the password to admin/admin after a factory reset.

If you join the dots, what this provides is the ability to reset a Nova locked router back to a generic state without needing to know the current admin password.

So, if you purchase a router that was originally supplied to Nova, fear not, because not only can you gain access to the router's admin interface, you can load a far nicer firmware image onto it as well.