Language: English
This talk presents a practical end-to-end attack chain against modern fiber access networks. By chaining multiple pre-authentication Remote Code Execution vulnerabilities, an attacker can compromise a GPON Optical Line Terminal and then pivot to the ISP’s cloud-based management platform. This escalation enables centralized and persistent control over all deployed OLTs. Such an attack can lead to large-scale service disruption, long-term unauthorized network access, customer traffic interception, and mass surveillance. The scenario mirrors real-world incidents involving nation-state actors targeting telecommunications providers. Technical details are being responsibly disclosed to the vendor and will be fully revealed at the conference, along with a demonstration video.
In this talk, we present a practical, end-to-end attack chain against modern
fiber access networks, demonstrating how multiple pre-authenticated Remote Code
Execution (RCE) vulnerabilities can be chained to fully compromise an ISP
infrastructure.
We begin by exploiting three pre-authenticated RCE vulnerabilities on a GPON
Optical Line Terminal (OLT), gaining initial access to a device that sits at a
critical point of ISP networks and directly handles customer traffic. From
the compromised OLT, we pivot into the ISP’s cloud-based fleet management
platform via an additional pre-authenticated RCE, ultimately obtaining
centralized and persistent control over all deployed OLTs managed by the
provider.
In large-scale deployments, OLTs are remotely administered through centralized
management platforms, making them highly attractive targets. By chaining
vulnerabilities between exposed edge devices and their associated cloud
management systems, an attacker can escalate from a single-device compromise to
full control over the access network infrastructure.
This attack path enables high-impact outcomes, including large-scale service
disruption, long-term unauthorized access to ISP networks, customer traffic
interception, and mass surveillance capabilities. These scenarios closely mirror
recent real-world disclosures involving nation-state actors covertly
compromising telecommunications providers in Western countries, where control
over ISP infrastructure has been leveraged for strategic intelligence collection
and population-scale monitoring.