Writing to password-protected SFP/QSFP/XFP: where the password lives and how brute force works
Users needed to write to password-protected SFP/QSFP/XFP modules from HP, Cisco, Finisar and JDSU. The thread documents the two protection levels: a host/user password protecting the user-writable area (A2h offset 7Bh on SFP, A0h offset 7Bh on QSFP/XFP) and a manufacturer password protecting the whole map inclduing serial and vendor fields, with the MSA default host password 00h 00h 10h 11h. The REVELPROG-IS programmer includes a password search tool.
- Transceivers: Finisar FTLF8524P2BNV, Sumitomo SFP+, generic SFP/QSFP/XFP
- Form factor: SFP, QSFP, XFP
Symptoms / messages:
write blocked by password
protected EEPROM area
Also available in: English
العربية
Deutsch
Español
Français
हिन्दी
Bahasa Indonesia
Italiano
日本語
한국어
Nederlands
Polski
Português
Русский
Türkçe
Tiếng Việt
简体中文
Comments 1
Write the 4-byte passord to A2h 7Bh (SFP) or A0h 7Bh (QSFP/XFP) before writing; try the default 00h 00h 10h 11h first. Host passwords (ASCII-limited) brute-force at about 300-4000 tries/second (hours to a few days), manufacturer passwords over the full 0x80000000-0xFFFFFFFF range take days to months; vendors often reuse the same password across a family.