Passive Optical Networks (PON) Share Downstream Traffic, Exposing Unencrypted Data to Neighboring Subscribers
What Happened – A Quarkslab technical overview explains that the downstream optical signal in GPON, XG‑PON, XGS‑PON, NG‑PON2 and 50G‑PON is broadcast to all optical network units (ONUs) on the same splitter. Only the intended subscriber can decrypt the payload; any unencrypted traffic (e.g., clear‑text DNS, legacy VoIP) is visible to every neighbor on the same PON segment.
Why It Matters for Trust & Control Assurance
- Continuous control‑assurance programs must verify that encryption and authentication are enabled on every PON link to prevent inadvertent data exposure.
- Evidence of encryption status (key derivation, MAC verification) becomes a required audit artifact for frameworks that demand protection of data in transit.
- Monitoring the configuration of OLT/ONU devices provides a defensible trail that demonstrates due‑diligence to regulators and customers.
Who Is Affected – Telecommunications service providers, ISPs deploying FTTH/FTTx, and any organization that relies on PON‑based broadband for critical communications.
Recommended Actions
- Confirm that the ITU‑T encryption and authentication mechanisms are activated on all OLT/ONU equipment.
- Integrate automated checks into your continuous monitoring platform to capture encryption‑status logs and flag any unencrypted downstream streams.
- Document encryption configurations as part of your audit evidence package for frameworks such as NIST CSF 2.0. Source: Quarkslab Blog
Technical Notes
- PON architecture uses a shared downstream broadcast; downstream frames are encrypted with a per‑subscriber AES key derived during the ONU registration phase.
- If the ONU does not support or is mis‑configured for encryption, clear‑text payloads traverse the optical splitter and can be captured by any neighboring ONU.
- No known CVE is associated with the protocol itself; the risk stems from optional security features not being enabled. Source: same as above