diff --git a/include/image-commands.mk b/include/image-commands.mk
index 1d694850195..dc6ee6e7c16 100644
--- a/include/image-commands.mk
+++ b/include/image-commands.mk
@@ -423,6 +423,8 @@ define Build/netgear-encrypted-factory
 		--output-file $@ \
 		--model $(NETGEAR_ENC_MODEL) \
 		--region $(NETGEAR_ENC_REGION) \
+		$(if $(NETGEAR_ENC_HW_ID_LIST),--hw-id-list "$(NETGEAR_ENC_HW_ID_LIST)") \
+		$(if $(NETGEAR_ENC_MODEL_LIST),--model-list "$(NETGEAR_ENC_MODEL_LIST)") \
 		--version V1.0.0.0.$(shell cat $(VERSION_DIST)| sed -e 's/[[:space:]]/-/g').$(firstword $(subst -, ,$(REVISION))) \
 		--encryption-block-size 0x20000 \
 		--openssl-bin "$(STAGING_DIR_HOST)/bin/openssl" \
diff --git a/scripts/netgear-encrypted-factory.py b/scripts/netgear-encrypted-factory.py
index b6bb72f3b87..40cfd9df0d2 100755
--- a/scripts/netgear-encrypted-factory.py
+++ b/scripts/netgear-encrypted-factory.py
@@ -14,6 +14,8 @@ def main():
     parser.add_argument('--model', type=str, required=True)
     parser.add_argument('--region', type=str, required=True)
     parser.add_argument('--version', type=str, required=True)
+    parser.add_argument('--hw-id-list', type=str)
+    parser.add_argument('--model-list', type=str)
     parser.add_argument('--encryption-block-size', type=str, required=True)
     parser.add_argument('--openssl-bin', type=str, required=True)
     parser.add_argument('--key', type=str, required=True)
@@ -26,6 +28,10 @@ def main():
     assert (encryption_block_size > 0 and encryption_block_size % 16 ==
             0), 'Encryption block size must be a multiple of the AES block size (16)'
 
+    hw_id_list = args.hw_id_list.split(';') if args.hw_id_list else []
+    model_list = args.model_list.split(';') if args.model_list else []
+    hw_info = ';'.join(hw_id_list + model_list)
+
     image = open(args.input_file, 'rb').read()
     image_enc = []
     for i in range(0, len(image), encryption_block_size):
@@ -45,13 +51,18 @@ def main():
     image_enc = b''.join(image_enc)
 
     image_with_header = struct.pack(
-        '>32s32s64s64s64s256s12sII',
+        '>32s32s64s64sIBBB13s200s100s12sII',
         args.model.encode('ascii'),
         args.region.encode('ascii'),
         args.version.encode('ascii'),
         b'Thu Jan 1 00:00:00 1970',  # static date for reproducibility
+        0,  # product hw model
+        0,  # model index
+        len(hw_id_list),
+        len(model_list),
+        b'',  # reserved
+        hw_info.encode('ascii'),
         b'',  # reserved
-        b'',  # RSA signature - omitted for now
         b'encrpted_img',
         len(image_enc),
         encryption_block_size,
diff --git a/target/linux/mediatek/image/Makefile b/target/linux/mediatek/image/Makefile
index 97164428e05..d4f79ec9749 100644
--- a/target/linux/mediatek/image/Makefile
+++ b/target/linux/mediatek/image/Makefile
@@ -6,6 +6,8 @@
 include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/image.mk
 
+DEVICE_VARS += NETGEAR_ENC_MODEL NETGEAR_ENC_REGION NETGEAR_ENC_HW_ID_LIST NETGEAR_ENC_MODEL_LIST
+
 loadaddr-$(CONFIG_TARGET_mediatek_mt7622) := 0x44000000
 loadaddr-$(CONFIG_TARGET_mediatek_mt7623) := 0x80008000
 loadaddr-$(CONFIG_TARGET_mediatek_mt7629) := 0x40008000
@@ -22,6 +24,10 @@ define Device/Default
   KERNEL_LOADADDR = $(loadaddr-y)
   FILESYSTEMS := squashfs
   DEVICE_DTS_DIR := $(DTS_DIR)
+  NETGEAR_ENC_MODEL :=
+  NETGEAR_ENC_REGION :=
+  NETGEAR_ENC_HW_ID_LIST :=
+  NETGEAR_ENC_MODEL_LIST :=
   IMAGES := sysupgrade.bin
   IMAGE/sysupgrade.bin := append-kernel | pad-to 128k | append-rootfs | \
 	pad-rootfs | append-metadata
diff --git a/target/linux/ramips/image/Makefile b/target/linux/ramips/image/Makefile
index c080456e7a7..265e9fb5e0c 100644
--- a/target/linux/ramips/image/Makefile
+++ b/target/linux/ramips/image/Makefile
@@ -7,6 +7,7 @@ include $(INCLUDE_DIR)/image.mk
 
 DEVICE_VARS += LOADER_TYPE LOADER_FLASH_OFFS LZMA_TEXT_START
 DEVICE_VARS += NETGEAR_BOARD_ID NETGEAR_HW_ID
+DEVICE_VARS += NETGEAR_ENC_MODEL NETGEAR_ENC_REGION NETGEAR_ENC_HW_ID_LIST NETGEAR_ENC_MODEL_LIST
 DEVICE_VARS += BUFFALO_TAG_PLATFORM BUFFALO_TAG_VERSION BUFFALO_TAG_MINOR
 DEVICE_VARS += SEAMA_SIGNATURE SEAMA_MTDBLOCK
 DEVICE_VARS += SERCOMM_HWNAME SERCOMM_HWID SERCOMM_HWVER SERCOMM_SWVER
@@ -179,6 +180,10 @@ define Device/Default
   SOC := $(DEFAULT_SOC)
   DEVICE_DTS_DIR := ../dts
   DEVICE_DTS = $$(SOC)_$(1)
+  NETGEAR_ENC_MODEL :=
+  NETGEAR_ENC_REGION :=
+  NETGEAR_ENC_HW_ID_LIST :=
+  NETGEAR_ENC_MODEL_LIST :=
   IMAGES := sysupgrade.bin
   COMPILE :=
   sysupgrade_bin := append-kernel | append-rootfs | pad-rootfs