Skip to content

Nokia G-010G-T – undocumented firmware 3FE49717AOCK87 (UART access) #513

Open

Description

@delorian9

Hello Hack GPON team!

I have a Nokia G-010G-T GPON ONT provided by Fiberhost/INEA in Poland.

I noticed that the documentation lists firmware versions AOCK12 and AOCK49, while my device reports a different version: 3FE49717AOCK87

Hardware details

  • Model: Nokia G-010G-T
  • Part number: 3FE49715ADAA
  • Hardware revision: 02
  • Firmware: 3FE49717AOCK87
  • Chipset: Realtek RTL9601D
  • SPI flash: Winbond W25Q128JVSIQ (16 MB)
  • Bootloader: U-Boot 2011.12.NA-svn145270
  • ISP: Fiberhost / INEA (Poland)

What I have tested

  • Connected to the UART interface using an ESP32.

  • Successfully captured boot messages at 115200 baud.

  • Accessed the ONT CLI and tested the available login/enable procedure.

  • The documented password generation methods did not provide working access to the Linux shell.

  • The device responds to ping at 192.168.100.1.

  • HTTP, SSH and Telnet do not appear to be accessible in the current configuration.

Related issues

I checked the following existing discussions:

My device is a G-010G-T rather than a G-010G-R, and the firmware version is different from those currently listed in the documentation.

Questions

  1. Is firmware 3FE49717AOCK87 already known to the project?

  2. Could this version use a different authentication algorithm or have additional access restrictions?

  3. Are there any specific UART commands or diagnostic outputs that would help identify the firmware differences?

  4. Is there any additional information I can collect through UART to help document this firmware version?

Additional information

I have physical access to the device and can communicate with it through UART using an ESP32.

I would be happy to perform additional non-destructive tests and share sanitized boot logs or diagnostic outputs if that would help improve the documentation.

Thanks for maintaining this project!

Activity

  1. Troll338cz commented on Oct 22, 2026

    @Troll338cz
    Contributor

    Hi, let me answer your questions so you can try to continue research.

    1. Yes its currently unknown, most likely version specific for your ISP
    2. Yes they can change the algorithm or hardcode passwords
    3. Can't compare much without having firmware dump or login
    4. If U-Boot access is possible use it to dump flash contents then reconstruct CramFS image so it can be looked at.

    Also worth a try sending Nokia factory packet it works on wide range of devices.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions