Hacking CA8271x XGS-PON Stick

Some information has been created with the help of @stich86_0046. Thanks!

• Rewrite S/N, Loid, PLOAM, etc… for your ISP FTTx
• Switch between 10GEPON and XGSPON.

This content is maintained by reverse engineering by enthusiasts. Use of this content is at your own risk!

XGS-PON ONT

10GE/XGS-PON ONT	Form	PON	SoC	OEM	Mgmt IP	Mgmt
CIG XG-99S	SFP+	XGS	CA8271S	-	192.168.100.1	UART/Telnet
CIG XE-99S	SFP+	10GE	CA8271S	-	192.168.0.1	UART/Telnet/SSH
ECIN EN-XGSFPP-OMAC End of Sales	SFP+	XGS	CA8271S	CIG XG-99S (old model)	192.168.100.1	UART/Telnet
ECIN EN-XGSFPP-OMAC-V2 Not CA8271x SoC	SFP+	XGS	MxL PRX126	AZORES WAS-110	192.168.11.1	Telnet/Web
FS XGS-ONU-25-20NI	SFP+	XGS	CA8271S	CIG XG-99S	192.168.100.1	UART/Telnet
Hisense LTF-726x-BH+	SFP+	10GE/XGS?	CA8271S	-	192.168.0.1	UART/SSH/Web
CIG XG-99M	ONT	XGS	CA8271A	-	192.168.0.1	UART/Telnet
Frontier FOX222	ONT	XGS	CA8271A	CIG XG-99M	192.168.188.1	UART
NTT 10G-EPON <O>C ONU <4>	ONT	10GE	NLD0605APB (CA8271 OEM)	-	192.168.1.1	UART
NTT 10G-EPON <M>C ONU <4>	ONT	10GE	NLD0605APB (CA8271 OEM)	-	192.168.1.1	UART

The CIG XE-99S and CIG XG-99S (and OEM’s) have the same hardware and can be switched by replacing the firmware.

Quick Start

XGS-PON

For the quick start of XGS-PON, we are porting it to Hack-GPON.org !
This github deals with more advanced information about EPON and Stick.

Menu

• UART pin
• ONT Login Password
  • emulate CIG ONT in QEMU
• How to get root CLI & root Shell
• ONT scfg.txt files (CORTINA SoC Configuration file)
  • default scfg.txt dump
• ONT Configuration
  • XG-99x Config Command
  • LTF-726x-BH+ Config
• NAND dump
  • Switch between XGS and 10GE
  • mtd dump & Bricked Stick Repair

switches dependent

• This Stick is reported to the SFP as an "unknown module". For this reason, some switches such as Alaxala will not link up. (i2c-0xA0 0x03 : 0x00)
• This Stick has its own vendor name registered in the vendor information, so it will not link up on switches with vendor lock enabled.
• Some switches may refuse to link up if the SFP LOS pin is High. In this case, fiber must be connected to the Stick.

Picture

FS XGS-ONU-25-20NI

CIG XE-99S

ECIN EN-XGSFPP-OMAC

Hisense LTF-726x-BH+

NTT 10G-EPON <O>C ONU <4> (OKI)

NTT 10G-EPON <M>C ONU <4> (MITSUBISHI)

---

This document is a work in progress. More updates will follow.