This project is a member of the OPEN PON FOUNDATION, led by Hacking RTL960x.
- 🔓 Rewrite Serial Number, LOID, PLOAM and ISP credentials
- 🔄 Switch between 10G-EPON and XGS-PON
- 🛠 Root shell, firmware modification and recovery
- 📚 Device compatibility database
- 🌏 Support SIEPON-A ISPs ( auひかり, eoひかり, コミュファひかり, Free/Iliad, etc )
Caution
Use of this content is at your own risk!
- This content is maintained by reverse engineering by enthusiasts.
- If ISP service is suspended due to modified ONT connected, you may be subject to punishment under the laws of your country.
- The creator of this content assumes no responsibility for any problems that may arise from this content.
This project promotes open knowledge and interoperability. Do not endanger shared infrastructure, Do not disrupt others.
10G EPON can be broadly categorized into the following three standards defined by IEEE 1904.1:
- SIEPON-A ( CableLabs DOCSIS DPoE-OAM ) Used by ISPs in the United States, Europe, Japan, and many other countries worldwide.
- SIEPON-B ( NTT-OAM ) Used exclusively by NTT East and NTT West in Japan.
- SIEPON-C ( ChinaTelecom-OAM ) Used only by ISPs within China.
Most commercially available ONTs are manufactured in China and support only SIEPON-C. However, by flashing custom firmware onto these ONTs, it is possible to enable support for SIEPON-A.
| Device | Default EPON | Mgmt IP | SIEPON-A Firm Support |
|---|---|---|---|
| Hisense LTF-7263-BH+ | SIEPON-C | 192.168.0.1 | ✅ |
| CIG XE-99S | SIEPON-C | 192.168.0.1 | ✅ |
Tip
The following devices use the same hardware and can be switched by changing the firmware.
- CIG XE-99S compatible.
- FS XGS-ONU-25-20NI
- CIG XG-99S
- ECIN EN-XGSFPP-OMAC-V1
- Hisense LTF-7263-BH+ compatible.
- Hisense LTF-7267-BH+
- XGS800E
You can also flash the SIEPON-A firmware onto these devices.
All SIEPON-A ONTs in the table below can be replaced with stick-type custom firmware.
| Device | EPON | SoC |
|---|---|---|
| NTT 10G-EPON <O>C ONU <4> | SIEPON-B | NLD0605APB (CA8271 OEM) |
| NTT 10G-EPON <M>C ONU <4> | SIEPON-B | NLD0605APB (CA8271 OEM) |
| NEC BL3000HM | SIEPON-A | CA8289 |
| Sumitomo FTE7263R | SIEPON-A | CA8271A |
All SIEPON-A ONTs in the table below can be replaced with stick-type custom firmware.
| Device | EPON | SoC |
|---|---|---|
| NEC H03XS1 | SIEPON-A | BCM55030 |
| NEC H03XS2 | SIEPON-A | BCM55030 |
| Sercomm BL4000HM | SIEPON-A | BCM68572 |
| DASAN H710 | SIEPON-A | BCM55030 |
| NOKIA XE-040G-A | SIEPON-A | BCM55030 |
| NOKIA NKFN11AEL | SIEPON-A | Broadcom ? |
| Free/Iliad F-MDCONU3A (v1) | SIEPON-A | BCM55030 |
| Free/Iliad F-MDCONU5A (v2) | SIEPON-A | BCM55030 |
| Free/Iliad P-MDONU4B (pro) | SIEPON-A | ? |
XG-PON / XGS-PON mainly use the following two transmission modes:
- PPTP
- VEIP
While many ISPs adopt VEIP, most ONTs based on the CA8271x currently do not support VEIP.
| Device | GPON | Mgmt IP | Info |
|---|---|---|---|
| CIG XG-99S | PPTP | 192.168.100.1 | |
| ECIN EN-XGSFPP-OMAC-V1 | PPTP | 192.168.100.1 | CIG XG-99S OEM |
| FS XGS-ONU-25-20NI | PPTP | 192.168.100.1 | CIG XG-99S OEM |
| Hisense LTF-7267-BH+ | PPTP | 192.168.0.1 | |
| NATYWISH LTF-7267-BH+ | PPTP | 192.168.1.1 | Hisense LTF-7267-BH+ NATYWISH Custom Firm |
| XGS800E | PPTP | 192.168.0.1 | Hisense LTF-7267-BH+ OEM |
Tip
The following devices use the same hardware and can be switched by changing the firmware.
- CIG XG-99S compatible.
- CIG XE-99S
- Hisense LTF-7267-BH+ compatible.
- Hisense LTF-7263-BH+
| Device | GPON | Mgmt IP | SoC | Info |
|---|---|---|---|---|
| CIG XG-99M | PPTP | 192.168.0.1 | CA8271A | |
| Frontier FOX222 | PPTP | 192.168.188.1 | CA8271A | CIG XG-99M OEM |
| HOSECOM X67S | PPTP VEIP | 192.168.1.1 | RTL9615C | |
| Nokia XS-2426X-A | PPTP VEIP | CA8289 | ||
| Nokia XS-2426G-B | PPTP VEIP | CA8289 |
- SIEPON-A Custom Firmware
- Shell access
- Configuration
- Firmware Modification & Recovery
- Device & SoC info
Note
Hardware dependent.
- This stick has a unique vendor name registered in its vendor information, the vendor information needs to be rewritten when connecting it to a switch with vendor locking enabled.
- Some switches may refuse to link up if the SFP LOS pin is High. In this case, fiber must be connected to the Stick.
| family | CPU | Applications |
|---|---|---|
| CA8271 | MIPS R3000 | This is an SoC optimized for SFU ONTs, providing the minimum PHY ports required for a bridge device, and the CPU uses the power-efficient MIPS architecture. |
| CA8289 | AArch64 Cortex-A55 4 Cores |
This SoC is optimized for HGU ONT, equipped with PHY for connecting multiple LAN devices, USB3.0, and PCIe for connecting WiFi SoC. The CPU uses high-performance ARM architecture. |
| RTL9615C | AArch64 Cortex-A55 2 Cores |
This SoC is a low-cost version customized based on the CA8289. The ARM core and memory channels are halved, and the interfaces are two XFIs and one 1G LAN. USB and PCIe are probably omitted. |
| CA7774 | AArch64 Cortex-A53 4 Cores |
This SoC is optimized for HGU routers. It has almost the same functions as the CA8289, and the CPU is Cortex-A53. It is for routers, so the PON IF is omitted. |
| SoC | family | CodeName | OEM Vendor | Applications |
|---|---|---|---|---|
| CA8271A | CA8271 | SATURN | CORTINA | Cable TV RF / PON SFU ONT |
| CA8271S | CA8271 | SATURN | CORTINA | SFP+ ONT Stick |
| NLD0605APB | CA8271 | SATURN2 | NTT Electronics | NTT-East/West 10GE-PON ONU in japan |
| CA8289 | CA8289 | VENUS | CORTINA | PON HGU ONT |
| RTL9615C | CA8289 base | TAURUS | Realtek | Realtek XG/XGS PON ONT |
| CA7774 | CA7774 | G3 | CORTINA | Router ( Without PON ) |
- XGS-PON quick start For the quick start of XGS-PON.
- Utility Script A useful script has been developed by @rssor
- xPON SFP ONU (RTL960x) The RLT960x hacking was carried out by @anime4000
- AZORES WAS-110 (MxL PRX126) The WAS-110 hacking was carried out by 8311 community.
- CableLabs DPoE 1.0
- CableLabs DPoE 2.0
Some information has been created with the help of :
Thanks!