T-Mobile 4G LTE CellSpot » History » Revision 12

« Previous | Revision 12/13 (diff) | Next »
eloy, 02/10/2022 01:03 AM

T-Mobile 4G LTE CellSpot

Any information that is and will be posted here is based on reverse engineering or using publicly available information, without private support from T-Mobile or Nokia. Use at your own risk.

The T-Mobile/Nokia branded version has been labled as the 4G LTE CellSpot V2 with the model "SS2FII Femtocell Multi-band SOHO". The Nokia-only branded version (pictured by the FCC) has been labeled with the model name "SOHO Small Cell V2 B2/B4". See the Nokia quick guide. According to Nokia, it has a IPSec with IKEv2 and a tamper alarm, so it is better not to disassemble the device to avoid triggering those. Using the LAN and WAN ports, it can be daisy-chained.

The device does not seem to support GSM, only UMTS and LTE. According to pictures of the internals by the FCC, the SoC is a Qualcomm FSM9955. This SoC incorporates a DSP by Qualcomm from the Hexagon series, see here for more detailed information. There is a Linux kernel for the FSM99xx series released, made with Yocto. According to the generic device tree include header, the FSM9900 series seems to be based on the 2012-era ARMv7 Qualcomm Krait cores. According to a Reddit post the FSM9955 also uses a Krait core, but I don't have the kernel sources to confirm this. Maybe request more recent kernel sources from T-Mobile or Nokia.

It has a GPS receiver because it is required by FCC regulations to locate callers to 911. I don't know if it is also used for region locking.


  • The device does not seem to have any open ports or web interface, this makes hacking it without disassembly very hard

Chips on the board

Main side

  • Qualcomm FSM9955, the main SoC
  • Qualcomm PMF9900 AU7192K4 U071904, unknown chip, maybe PMF is power management functionality
  • QCA8334-AL3C, Ethernet switch
  • Samsung K4B4G1646E-BYK0, DRAM

Back side

  • Qualcomm FTR8900, RFIC

Prior research to other femtocells

Early Vodafone femtocell
PhD thesis on femtocell security
Root on Samsung femtocell
Article about Hexagon and femtocells

Files (0)

Updated by eloy about 2 years ago · 12 revisions

Add picture from clipboard (Maximum size: 48.8 MB)