logo elektroda
logo elektroda
X
logo elektroda

[TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown

nihildiximus 4566 9
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
📢 Listen (AI voice):
  • Producer: Ezvis
    Model: CS T30 10A


    Socket with FW dedicated to the Ezviz application, but it is also sold by other manufacturers as WiFi socket WG08 Tuya and then it can be added directly to the Tuya application. I decided to do a teardown because I don't see anyone looking at the Ezvizes anywhere...


    [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown


    teardown:


    To remove the top plug at the socket, just pry it up. Unfortunately, removing the PCB without destroying the housing seems impossible. An attempt to knock out and unscrew the pins gave nothing, so they were probably sunk in the plastic of the housing. Unfortunately, even heating them with hot air did not help. Desoldering them and removing them from the PCB is also not an easy task - I managed to collect tin from the outside, but a lot of it was left on the bottom of the board and there was no way to melt it. Trying to remove the plastic in the middle holding the socket plates, one of them fell off. The only way to disassemble was to cut the casing. I've done it so that it can be easily glued if needed...

    [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown
    [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown

    Microcontroller: TYWE2S (ESP8285)
    PCB: WG08(10)V1.4 7/20/29


    [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown

    Inside there is a quite popular TYWE2S microcontroller, compatible with ESP, so theoretically you can throw FW Tasmota and EspHome.
    In practice, this involves either destroying the device's housing and soldering it to the board, or you could make a small PCB (or some wire structure on a piece of tape or something similar) to size with the corresponding pin spacing, try to stick it to the TYWE2S board, or catch on a magnet and then program. However, this is a daunting task.

    Tuya-convert over Wifi turned out to be ineffective. I wanted to check if it will start after shorting GPIO0 to GND, but after inserting the plug there was some short circuit and gray smoke went. Probably during heating and trying to pull out the pins some tin poured where it shouldn't, but fortunately the strip, UPS and fuses passed the test positively. ;) In the face of this fact, I decided to finish the work and it turned out that some layout was fried from the bottom ...

    [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown
    [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown


    To sum up: Although programming the TYWE2S itself should not be a problem, I advise against buying these sockets due to the construction, which makes it extremely difficult to do anything with them. There is so much talk about ecology and recycling, and devices are allowed for sale that are apparently specially designed to make it as difficult or even impossible to dismantle and repair them...

    Cool? Ranking DIY
    About Author
    nihildiximus
    Level 9  
    Offline 
    nihildiximus wrote 32 posts with rating 23, helped 1 times. Live in city Wrocław. Been with us since 2018 year.
  • ADVERTISEMENT
  • #2 20549598
    gulson
    System Administrator
    Posts: 29484
    Help: 150
    Rate: 6105
    As always, a great publication! The plugin is quite popular in Poland. It is, for example, in Media Markt. Sometimes there are interesting promotions on the plug.
    You're right, they make it more and more difficult to update the firmware.
  • ADVERTISEMENT
  • Blitzwolf and NEO/NAS alternatives for easy firmware access

    #3 20552125
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14747
    Help: 659
    Rate: 12848
    Interesting material, thank you for posting it, here are some comments from me:
    - if we want something easy to change the firmware and to open, it is worth considering Blitzwolf products. I think I even described the BW-SHP6 on the forum. They can be dismantled without spoiling. As far as I know, Blitzwolf has never been reported to have anything other than ESP8266/ESP8285 inside, but I could be wrong.
    - the date on the PCB is interesting, according to my observations, the BK versions appeared a bit after 7/20/29, so your socket is still from older batches
    - if you want something easy to open or at least proven, you can look for it on this list: https://openbekeniot.github.io/webapp/devicesList.html -WR01W I came up with this:
    [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown
    I described the NEO/NAS shown above in both the BK and ESP versions. Here is a link to the ESP version (older):
    https://www.elektroda.pl/rtvforum/topic3941251.html
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • Fastest flash method via desoldered P25D80H

    #4 20552801
    nihildiximus
    Level 9  
    Posts: 32
    Help: 1
    Rate: 23
    I have several Neo NAS-WR01W, but I approached the matter a little differently. After unscrewing the triangular screw (I sawed off the star bit to unscrew it) and ejecting the electronics by pushing out the pins, you can desolder the P25D80H visible next to the ESP, solder it to the SOP base on DIP and throw the FW through the programmer. I used XGecu T48, but even CH341A should be enough. This is probably the fastest and least invasive way. ;)
    [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown

    Added after 2 [minutes]:

    I'm going to add this info in the linked entry about Neo, because maybe someone will find it useful. ;)
  • ADVERTISEMENT
  • #5 20555282
    Oddawajsanki
    Level 8  
    Posts: 84
    Rate: 7
    very nice such a plugin, I have it myself, it's a revelation!
  • Ground plate movement can short U1 without the top cap

    #6 20572217
    grzegorz.85
    Level 11  
    Posts: 5
    Hello,

    I repeated the brute-fore teardown done by my colleague @nihildiximus, and I confirm his opinion that disassembly without destroying the case is practically impossible - maybe if someone had a desoldering / desoldier-gun and stripped all the tin from the socket pins.

    However, I would like to add an alternative cause of shorting and burning of the U1 chip.
    @nihildiximus in his post suggested that his circuit probably burned up due to attempts to pull out the pins, heating and finally spilled tin.
    In my case, the exact same circuit (converter?) is damaged (although not so spectacularly), and the only thing I did was remove the top plug and without it I connected the device to the socket.
    In my opinion, the way of mounting the ground plate is to blame for this situation - without the upper cap, it has no support point, and when plugging the device into the socket, there is a risk that the socket pin will move this plate towards the PCB, and this will cause a short circuit - I think that was my case.
    To my eye, there is about 5mm between the default location of this plate and the surface of the PCB. This plate is arranged in such a way that it runs in the vicinity of the L-In, L-Out, U1, C8 and L2 solder pads. If to

    The U1 circuit on my board - you can try to read some markings; I couldn't find anything.
    [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown

    The method of arranging the ground plate in relation to the mentioned U1, L2, C8 and L-In/L-Out:
    [TYWE2S] Ezviz CS-T30 10A EU (WG08(10)V1.4) brute-force teardown
    I apologize for the quality of my descriptions in the image - the vertical fields on the left, closer to the U1 system, are C8, while the fields slightly to the right and diagonally are L2.

    Conclusion: Before plugging the device into the socket, assemble it so that the ground plates have support points and cannot move.

    Additionally: Despite the damaged U1 chip, I successfully soldered it to TYWE2S, and with the 3V3 power supplied from the outside, the original firmware started: the button and the LEDs worked. I uploaded the tasmota, and again - with the 3V3 power supplied from the outside, the module started. So you can try to replace the U1 and restore the board to full efficiency, or get a TYWE2S for DIY purposes.
  • #7 20572248
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14747
    Help: 659
    Rate: 12848
    I hope you tried the method before looking inside tuya-convert :
    https://www.elektroda.pl/rtvforum/topic3769864.html
    There is always a chance to succeed, not all products on the market are patched before this method. A few months ago I managed to program the BK-Licht LED lamp like this:
    https://www.elektroda.pl/rtvforum/topic3909988.html
    Helpful post? Buy me a coffee.
  • Thermal fuse blown and U1 identified as KP3210BSGA

    #8 20572837
    grzegorz.85
    Level 11  
    Posts: 5
    Unfortunately, I did not check tuya-connect - I suggested the entry of @nihildiximus, who wrote that he tried, and in my case the PCB is exactly the same version.
    Learning sometimes requires sacrifices - this time small, because these sockets are currently on sale (PLN 10) in one of the French grocery stores with the letter "C".
    I still have a few of these sockets, so when I finish playing with the corpse of the current one, I will definitely try the tuya-connect method on the next one.

    In the case of these corpses, I can send you some additional information:
    1. between the soldering points of the plug pins there is a 105 degrees Celsius thermal fuse - in my case everything indicates that the heating around the pins in order to release them blew the fuse - for me it is another proof that the device is constructed as non- serviceable.
    2. The name of the U1 chip was finally deciphered: KP3210BSGA - unfortunately it is not available in our country, and in a popular store with CN on "A" the price exceeds PLN 10 I paid for the entire socket.
  • #9 21531069
    123Kaczynski
    Level 1  
    Posts: 1
    Rate: 1
    Hi, I have another CS-T30-10B plug that refused to work after a few months. It just switched itself off . Is it in the bin because that's where it belongs?
    I don't feel I can do anything to improve it.
    Best regardsPiotr
  • #10 21532950
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14747
    Help: 659
    Rate: 12848
    Can't pair with the app again? Reset?

    If you want, you can also send me the plug-in to be flashed, I will test it, change the firmware and send it back to you, but the postage is covered by you. Unless it is broken, in which case it is difficult to judge....
    Helpful post? Buy me a coffee.
📢 Listen (AI voice):

Topic summary

✨ The discussion focuses on the teardown and firmware modification challenges of the Ezviz CS-T30 10A EU smart socket, also sold as the WG08 Tuya WiFi socket. The device features a firmware dedicated to the Ezviz app but can be integrated with the Tuya platform. Physical disassembly without damaging the housing is nearly impossible due to pins embedded in plastic and a thermal fuse rated at 105°C between solder points. Attempts to desolder pins and remove the PCB are difficult and risk damaging components, including the U1 chip (KP3210BSGA). Alternative approaches include using tuya-convert for firmware flashing without hardware teardown, though success varies depending on firmware patching. Comparisons are made to Blitzwolf products (e.g., BW-SHP6) and Neo NAS-WR01W sockets, which are easier to open and reflash. A method involving desoldering the P25D80H flash chip and programming it via SOP-to-DIP adapter with programmers like XGecu T48 or CH341A is suggested for Neo devices. The mounting design of the ground plate in the Ezviz socket may cause short circuits when the top plug is removed, potentially damaging the converter chip. Some users report device failures after months of use, with limited repair options. Offers to flash firmware externally are mentioned, contingent on shipping costs and device condition.
AI summary based on the discussion. May contain errors.

FAQ

TL;DR: 10 A Ezviz CS-T30 sockets use TYWE2S; "practically impossible" opening makes this FAQ useful for Tasmota users solving teardown, U1 burn, and recovery issues. Expect destructive cutting, 3.3 V module testing, and safer alternatives like BW-SHP6 or NAS-WR01W. [#20572217]

Why it matters: The CS-T30 shows how a cheap ESP-based smart plug can become risky and uneconomical to repair when the enclosure blocks safe access.

Option Module / method Opening difficulty Firmware path
Ezviz CS-T30 10A EU TYWE2S / ESP8285 Case cutting often required Solder to TYWE2S or try tuya-convert first
BlitzWolf BW-SHP6 ESP8266/ESP8285 reported Opens without damage Better candidate for custom firmware
Neo NAS-WR01W ESP version with P25D80H Triangular screw, pins pushed out Desolder flash and program externally

Key insight: Do not power the CS-T30 while the top cap is removed. The loose ground plate can move about 5 mm toward live PCB areas and short the power supply section.

Quick Facts

  • The tested Ezviz CS-T30 10A EU board is marked WG08(10)V1.4 7/20/29 and contains a TYWE2S ESP8285-compatible module. [#20549585]
  • The U1 supply chip was identified as KP3210BSGA; one user found it cost more than PLN 10, the sale price of the complete socket. [#20572837]
  • A 105 °C thermal fuse sits between the plug-pin solder points, so heating the pins can disable the device. [#20572837]
  • With U1 damaged, the TYWE2S module still booted from external 3V3 power; both original firmware and Tasmota started. [#20572217]
  • On the CS-T30, the ground plate has about 5 mm clearance to the PCB and can short near L-In, L-Out, U1, C8, and L2 if unsupported. [#20572217]

How can I safely open an Ezviz CS-T30 10A EU smart plug without destroying the housing?

You cannot reliably open it safely without damaging the housing. The top plug can be pried off, but the PCB remains trapped by embedded pins and plastic. Attempts to knock out, unscrew, heat, or desolder the pins failed. The successful teardown used cutting, shaped so the housing could later be glued. Do not plug it in while opened, because unsupported metal plates can move. [#20549585]

Why is the Ezviz CS-T30 / WG08(10)V1.4 smart socket so difficult to disassemble and repair?

The socket resists repair because its plug pins and internal plates lock the PCB inside the plastic body. The board version is WG08(10)V1.4, dated 7/20/29. Desoldering the pins left solder under the PCB, where it could not be melted cleanly. Heating also failed and can damage the 105 °C thermal fuse. This design makes firmware work and physical repair unusually difficult. [#20549585]

What is the TYWE2S module in the Ezviz CS-T30, and how is it related to ESP8285?

TYWE2S is the WiFi microcontroller module inside the Ezviz CS-T30. "TYWE2S is an ESP-compatible WiFi module that provides the plug’s smart control logic, using an ESP8285-class platform suitable for firmware such as Tasmota or ESPHome when physical access is available." The teardown identified TYWE2S directly on the PCB. The plug also carries the WG08(10)V1.4 board marking. [#20549585]

How can I flash Tasmota or ESPHome onto the TYWE2S module inside an Ezviz CS-T30 plug?

Flash it by accessing the TYWE2S programming pins and using external 3.3 V logic-level programming. 1. Open the housing, accepting that cutting may be required. 2. Solder to TYWE2S, or build a temporary contact jig matching the pin spacing. 3. Flash Tasmota or ESPHome, then test the module before mains use. This is difficult because the TYWE2S sits inside a hard-to-remove PCB assembly. [#20549585]

Why did tuya-convert fail on the Ezviz CS-T30 smart plug, and what alternatives are available?

tuya-convert failed on the tested Ezviz CS-T30 over WiFi. "tuya-convert is an over-the-air flashing method that targets compatible Tuya devices over WiFi, avoiding soldering when the original firmware remains vulnerable and accepts the update path." Alternatives are direct TYWE2S flashing, a pin-contact jig, or choosing easier hardware first. One expert advised trying tuya-convert before opening, because not every market unit is patched. [#20572248]

What causes the U1 chip to burn on the Ezviz CS-T30 when the plug is powered with the top cap removed?

The U1 chip can burn when the unsupported ground plate shifts toward the PCB. With the top cap removed, the plate lacks a support point. During insertion, a socket pin can push it near L-In, L-Out, U1, C8, and L2. One teardown estimated about 5 mm between the plate and PCB. Reassembling the cap before powering prevents this failure path. [#20572217]

What is the KP3210BSGA chip used for in the Ezviz CS-T30 power supply circuit?

KP3210BSGA is the identified U1 chip in the CS-T30 power supply area. "KP3210BSGA is the U1 power-supply circuit device that sits near L-In, L-Out, C8, and L2, and failure there can stop the board while leaving the TYWE2S module usable from external 3V3 power." A replacement was hard to source locally and cost more than PLN 10 from one overseas marketplace. [#20572837]

How can I power and test the TYWE2S module externally with 3.3 V after the Ezviz CS-T30 board is damaged?

Supply regulated 3V3 directly to the TYWE2S module and keep it isolated from mains. One damaged board had a failed U1 chip, but the TYWE2S still booted from external 3V3. The original firmware started, and the button and LEDs worked. After flashing Tasmota, the module again started from the same external 3V3 supply. This proves the module can be reused even when the board supply fails. [#20572217]

What precautions should I take before plugging in a partially disassembled Ezviz CS-T30 smart socket?

Reassemble the plug so the ground plates have firm support before applying mains power. Do not power it with the top cap removed. The loose plate can move toward the PCB during insertion. It runs near L-In, L-Out, U1, C8, and L2, where a short can burn U1. Treat exposed mains areas as dangerous and test low-voltage sections separately. [#20572217]

How does the Ezviz CS-T30 compare with BlitzWolf BW-SHP6 for users who want to flash custom firmware?

BlitzWolf BW-SHP6 is the better choice when easy disassembly matters. A forum expert stated that BlitzWolf products can be dismantled without damage and are worth considering for firmware changes. He also reported no known BlitzWolf cases with something other than ESP8266 or ESP8285 inside, while noting that this could be incomplete. The Ezviz CS-T30 instead often requires destructive opening. [#20552125]

What is tuya-convert, and how does it flash smart plugs over WiFi?

tuya-convert is a WiFi firmware-change method for compatible Tuya-based devices. "tuya-convert is an over-the-air flashing tool that programs supported smart plugs without opening them, but only when the device firmware has not blocked that update route." One expert recommended trying it before teardown, because some products still accept it. He cited a BK-Licht LED lamp successfully programmed this way a few months earlier. [#20572248]

What is Tasmota, and why do people install it on Tuya or Ezviz smart plugs?

Tasmota is custom firmware installed to control ESP-based smart devices outside the vendor app. "Tasmota is replacement firmware for ESP8266 and ESP8285-class smart devices that lets users reconfigure local control behavior after flashing through serial access or a supported OTA route." In this thread, users targeted TYWE2S and ESP8285 hardware inside the CS-T30. One damaged plug booted Tasmota from external 3V3 power. [#20572217]

How can I flash a Neo NAS-WR01W smart plug by desoldering the P25D80H flash chip with an XGecu T48 or CH341A programmer?

Flash the Neo NAS-WR01W by programming its P25D80H flash chip externally. 1. Remove the triangular screw using a modified bit if needed. 2. Push out the pins and remove the electronics. 3. Desolder the P25D80H, place it in a SOP-to-DIP adapter, and write firmware with XGecu T48 or CH341A. The poster called this the fastest and least invasive method. [#20552801]

What should I check when an Ezviz CS-T30-10B plug switches itself off after a few months and will not work again?

Check pairing, reset behavior, and whether the plug can be flashed or tested before discarding it. A user reported a CS-T30-10B that switched itself off after a few months. The response asked whether it could pair with the app again or reset. The same responder offered to test and flash it, with postage covered by the owner. A true hardware failure still requires diagnosis. [#21532950]

Where can I find smart plugs that are easier to open and known to work with ESP8266, ESP8285, or OpenBeken firmware?

Look at the OpenBeken devices list and forum-documented models such as BlitzWolf BW-SHP6 and Neo NAS-WR01W. The expert recommended the OpenBeken list for proven devices. He also pointed to WR01W examples and described Neo/NAS units in both BK and ESP versions. For ESP-focused flashing, BlitzWolf was recommended because it can be opened without damage. [#20552125]
AI summary based on the discussion. May contain errors.
ADVERTISEMENT