Updating the firmware on subscriber ONTs and routers is a job every ISP knows it has to do, and one that a lot of technical teams keep putting off. The hesitation has a reason. A new version pushed to the entire fleet without testing can bring the Wi-Fi back with its factory name and password, drop PPPoE in part of the homes and flood the support queue the next morning. Leaving the fleet on a three-year-old version has a cost too, though, in known security flaws and in bugs the vendor fixed long ago.
In our experience, what separates a quiet maintenance window from a wave of support calls is how the batch was put together. Splitting the fleet by vendor, model, hardware version and firmware version, testing on a handful of devices, running the job overnight and retrying only what failed removes most of the risk. With a TR-069 ACS, none of it requires going house to house.
Why update ONT and router firmware?
CPE firmware needs updating because that is where the vendor fixes security flaws, Wi-Fi bugs, freezes that only show up after weeks of uptime and incompatibilities with features such as IPv6.
Security has been carrying more weight in that decision. The NETSCOUT report on the first half of 2026, covered by Brazilian outlet Convergência Digital, counted 487,415 DDoS attacks in Brazil between January and June, and wireless telecommunications carriers (except satellite) were the main target, with 141,400 attacks. The CPE is part of this picture because a home router with an old flaw and a default password is a common botnet recruit, something we cover in detail in our post on DDoS attacks on ISPs. Updating closes flaws that are already public and catalogued, which are the first ones an automated scanner looks for. That shrinks the known attack surface, although it does not make the device immune.
What can go wrong in a bulk firmware update
A bulk firmware update can go wrong in four ways, and usually only the first one shows up as a failed task.
The first is the device that never comes back, because power dropped mid-write, the file was built for another hardware revision or the memory can't hold the new image. The ONU goes silent and almost always turns into a truck roll, with a technician sent to the home. The second is the configuration reverting to defaults, since some versions apply factory values after the upgrade and the subscriber wakes up with every device in the house disconnected.
The other two take longer to surface, because the task is marked as completed. TR-069 is a standard, but each vendor keeps a good share of its parameters in proprietary branches (the ones starting with X_), and a new version can move a parameter to a different path or stop exposing it altogether. A few days later, tier 1 support tries to change a subscriber's Wi-Fi password and can't, or the optical power reading disappears from the screen.
That is why the IXC ACS help center warns that devices on mixed firmware behave like different models. Two ONUs of the same model, each on a different version, may expose the Wi-Fi password or the WAN VLAN at different paths, and the update batch has to respect that split.
Update ONT firmware by hand or through the ACS?
By hand, the options are each device's web interface or a field visit, and neither one keeps up with the size of a fleet. With the web interface, someone logs into each CPE, uploads the file and checks that it came back from the reboot, one device at a time and with no central record. A truck roll does fix the frozen device, but it burns fuel and technician hours on a task that doesn't need anyone inside the home.
Through the ACS, the work runs over TR-069 (CWMP), the protocol in which the CPE connects to the auto-configuration server to be configured and diagnosed. The ACS sends the CPE the address of the file. The CPE downloads it, writes it, reboots and, in its next session, reports that the transfer is complete, so the platform knows which devices updated and which were left behind without anyone keeping a spreadsheet. IXC ACS is installed on the ISP's own infrastructure with access to the CGNAT network, which means subscribers without a public IP also receive the command right away. The only devices left pending are CPEs that are powered off or have lost their ACS URL setting, until they talk to the ACS again.
At a Brazilian ISP analyzed over 6 months (2025-2026), across tens of thousands of support interactions, subscribers whose CPE was managed by IXC ACS had 62% fewer truck rolls than subscribers without a CPE in the ACS. The figure measures the effect of a managed CPE on support as a whole, and firmware updates are only one part of it.
Step by step: bulk firmware update in IXC ACS
The bulk firmware update sits under Tools menu > Bulk updates > Firmware and goes through three screens: device selection, file selection and scheduling. This is the sequence we recommend:
- Get the file from the vendor or from whoever supplied that batch of equipment, for the exact model and hardware revision. Firmware downloaded from a forum or passed along by another ISP stays out.
- Click New update and fill in vendor, model, hardware and current firmware. Each combination of those four fields is a separate batch.
- Choose a file already registered in the ACS or upload a new one, entering the version, file type and tags.
- Select 2 or 3 devices first, as the help center itself recommends, ideally from your own team or from subscribers your support staff can reach easily. Check that each one came back, reported the new version, still has Wi-Fi and PPPoE and still accepts a password change through the ACS.
- Once the pilot passes, build the full batch, use Schedule start to pick a low-traffic time (usually the middle of the night) and confirm with your user password.
- Track the total number of devices along with the updated, rejected or unfinished, and pending ones. If you need to stop the task, stopping it only affects devices that haven't been updated yet.
- At the end, use Redo update. It only targets the devices that failed and keeps the model, hardware and firmware from the original task.
If more than 30% of the devices fail, reject the file or time out, the system stops the task and marks it as Failed, which catches a wrong file before it reaches the whole batch. For the update to show as Completed, it has to succeed on more than 90% of the devices.
How do you know the new version is still compatible?
Compare the version you are about to apply with the model's certified version before you build the batch. Certification covers the hardware and firmware versions that were actually tested, and on any other version, support for each function is an assumption until someone checks.
On the pilot device, open Devices, then the three-dot menu > About, and read the Capabilities screen, which shows the badge and the status of each function group (functional, partially functional, no capability). Add a manual test of the functions your support team uses most. If any of them stopped working after the update, contact support with the new version number and ask for a certification review.
In case the new version restores defaults, leave Automatic Reconfiguration enabled under System menu > Settings > ACS. The preset reapplies the ISP's pre-configuration when the device comes back from a reset. Whether that restore actually happens depends on the model, so confirm it during the pilot.
Frequently asked questions
Does a firmware update wipe the subscriber's configuration? It depends on the version. Many keep the configuration, but some go back to factory values after the upgrade. The pilot tells you which case you're dealing with, and the ACS Automatic Reconfiguration reapplies the pre-configuration on models that support restore after a reset.
Can you update an ONU behind CGNAT? Yes, and right away. IXC ACS is installed with access to and reach into the ISP's CGNAT network, so it gets to the CPE and triggers the update on demand, just as it would for a subscriber with a public IP. Only devices that are powered off or have lost their ACS URL setting stay pending, and they receive the command when they come back online.
How often should I update ONU firmware? There's no fixed schedule. Update when the vendor releases a security fix or a fix for a bug that affects your fleet, and only after checking the new version against the certification for that model and hardware.
Can I use firmware from another ISP or another region? It's not recommended. Custom builds can carry another ACS URL, different defaults and a different Wi-Fi regulatory domain, and the CPE may lose its ACS setting or freeze. Ask your supplier for the file, and if the device drops out of the ACS, review the TR-069 ACS URL configuration.
Checklist for your next update window
- File obtained from the vendor or supplier, for the exact model and hardware.
- Batch split by vendor, model, hardware and current firmware.
- New version checked against the model's certification.
- Pilot on 2 or 3 devices, with Wi-Fi, PPPoE, optical power and password change tested.
- Support team told about the window and briefed on what to ask if a subscriber calls.
- Job scheduled overnight, failures retried right afterward and the applied version logged for each batch.
The next morning, compare that day's tickets with a typical day. If they didn't go up, the next window can be larger. If they did, look first for a batch that mixed firmware versions. To see this workflow running on your own fleet, click the button below and talk to our team.