This information was taken from https://slickdeals.net/f/11788767-t-mobile-wi-fi-cellspot-router-60-free-shipping?src=SiteSearchV2_SearchBarV2Algo1

Use at your own risk.

You can flash this router to an RT-AC68U: http://www.bayareatechpros.com/ac1900-to-ac68u/. There are few change/additions needed in the guide before the latest ASUS firmware can be flashed, though.

Flashing TM-AC1900 to RT-AC68U

• Avoid CFE 1.0.2.5 from the RT-AC68P, as the newest Asus firmwares (3.0.0.4.384.20624 and later) detect this on the TM-AC1900 and revert the mod. Instead, use CFE 1.0.2.0 US AiMesh; it was dumped from an actual RT-AC68U by user goggles99 at SNB. The CFE generator [pipeline.sh] by danielfenghas this version available.
• Some TM-AC1900 ship with a firmware version that allows SSH access. If you get one of these, you can skip steps 5-10 of the guide. To check if you have SSH available, go to Administration > System in the router configuration interface. If your firmware permits SSH, there will be a setting to Enable SSH. If so, choose Yes, then Apply. Move on to step 11.
• The T-Mobile certificates have to be wiped from the mtd5 partition. This can be done after all of the steps in the guide have been completed, but must be done before any newer version of ASUS firmware is flashed. As of this writing, the firmware included in the bayareatechpros guide is 3.0.0.4.376.3626, so the steps below should be performed when this version is running on your router.

Wiping T-Mobile certificates from the mtd5 partition

These instructions originally existed on SNB before that forum thread was shut down [snbforums.com]. Credit to XVortex and rdallen. After you’ve performed these steps, you can flash 3.0.0.4.384.21045 (and possibly newer) using the GUI.

# Backup MTD5 (dd produces identical bin)
cat /dev/mtd5 > /jffs/mtd5_backup.bin

# Copy mtd5_backup.bin from router using scp
# From host: scp admin@192.168.1.1:/jffs/mtd5_backup.bin ./

# Mount MTD5
mkdir /tmp/asus_jffs
mount -t jffs2 /dev/mtdblock5 /tmp/asus_jffs

# Copy mtd5 files from router using scp
# From host: scp admin@192.168.1.1:/tmp/asus_jffs/* ./

# Wipe mtd5 files and reboot
rm -rf /tmp/asus_jffs/*
sync && umount /tmp/asus_jffs
rm -rf /jffs/.sys/RT-AC68U
nvram unset fw_check && nvram commit && reboot

—–

ASUS RT-AC68U firmware downloads [asus.com]

SNB now disallows discussion [snbforums.com] about converting TM-AC1900 to RT-AC68U with AiMesh. So, modding information may be a bit harder to come by going forward. Some discussion has moved to this thread [whirlpool.net.au] on whirlpool.

Other Tips:

If you are having problems accessing the mini-CFE webserver this works:

1. Power off the router using the power button
2. Set your PC’s IP to 192.168.29.2 (assuming the recovery mode is gateway is 192.168.29.1)
3. Navigate to 192.168.29.1 using your browser — the browser continue to try and access the page until it is available
4. Press and hold the reset button while powering-on the router
5. When the mini-CFE webpage appears on the browser, release the reset button
6. As long as the browser status is still spinning — looking for a webpage — the mini CFE web page will load