VoIP hardware is developing fast - this is where you ask all those “how do I make my SIP Telephone, Adapter or Asterisk box work with my voip provider?” questions.


By Sponsor


By Sponsor
User avatar
By WelshPaul
Hi Tony,

I have come across this issue before and it's not good news i'm afraid...

In every past case it was because the IP phone was not a standard generic retail device. Do you have the box? Look on the box for the following product number: Cisco SPA525G2 RC SKU. The -RC sku's are a special sku for service provider customers to do a no touch configuration prior to install in a hosted mode. The phone will load a service provider specific configuration but since the phone is not assigned to a SP it cannot be configured. Basically the phone locked to a service provider!

Best option would be to return the phone for a refund or replacement.
User avatar
By WelshPaul
The Cisco SPA phones are VERY secure and as far as I am aware, the eeprom also being secure does not allow direct access. I don't think anyone has managed hack/unlock a SPA IP phone using the JTAG method.

For the record, I don't think VoIP phones should be locked down to a single provider unless it's provided free of charge, on loan or leased by a service provide. It just adds to landfill waste. :-/
User avatar
By AntalVincz
Yes, SPA phones is tricky. :-)

I do not understand why not public is the master reset procedure.
So really just growing mountains of garbage.

In any case, the internal serial port can be tried.
Just be aware that 3.3 Volts serial adapter must be used.
Available on eBay. It also has.

The list of SPA 525 serial commands:

VOIP>> help
? - alias for 'help'
autoscr - run script from memory
base - print or set address offset
bbothcode - Burn a code.bin on the flash.
bcode - Burn a code.bin on the flash.
bdinfo - print Board Info structure
bhome - Burn home partition on the flash.
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
bubt - Burn an image on the Boot Flash.
chpart - change active partition
cmp - memory compare
cmpm - Compare Memory
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
echo - echo args to console
erase - erase FLASH memory
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
flinfo - print FLASH memory information
fsinfo - print information about filesystems
fsload - load binary file from a filesystem image
g - start application at cached address 'addr'(default addr 0x40000)
go - start application at address 'addr'
gstburn - write all files from USB file storage disk to flash.
gstload - enables the USB file storage gadget.
help - print online help
iminfo - print header information for application image
imls - list all images found in flash
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
ls - list files in a directory (default /)
md - memory display
mm - memory modify (auto-incrementing)
mtderase - Erase the whole partition.
mtdparts- define flash/nand partitions
mtest - simple RAM test
mw - memory write (fill)
nand - NAND sub-system
nboot - boot from NAND device
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sleep - delay execution for some time
tftpboot- boot image via network using TFTP protocol
version - print monitor version

The serial port parameter: 38400, N, 8, 1

The serial port PIN-s left to right:


When after connected the serial port adapter to the phone pins, starting the terminal program (PUTTY or another).
Connecting the phone POE SW or 5Volt DC supply.
When booting the phone press ESC to step to secret menu.

I think this is the CPU bootloader menu.

The SPA 525 phones LAN range 192.168.0.x
The phone LAN interface set up automatically this range.
And the phone try connect the TFTP server address if use the rarpboot or tftpboot command.

Similar to the serial port is SPA502 and 504 as well.

Jose liked this
User avatar
By AntalVincz
Hi Jose,

I double checked this:

The serial port parameter: 38400, N, 8, 1

The serial port PIN-s left to right:


And that is good.

Yes the five pin connector that is (J3).
Some time not install the pin connector. Don't worry, soldering some little wire to.


GND ---- > your USB/TTL adapter GND
RXD ---- > your USB/TTL adapter TXD
TXD -----> your USB/TTL adapter RXD

This is 38400, N, 8, 1 the default serial speed.
If possible change that.
If you look the PUTTY screen unknown characters try change the PUTTY serial port speed.

Actually I think if the phone customization status is pending or show provider name (for example Vodafone) just have one solution, the complete reflashing the phone.
Maybe use to the JTAG.

But of course necessary the all file, and more information for example the flash memory map.


User avatar
By AntalVincz
Hi Jose,

Wait patiently until the phone is fully booted.
If you connected to the serial port, you can tracking the fully boot process.
After the phone finished the boot process available the VOIP>> prompt.
The phone request the IP address, important your network have the DHCP server (Linux, Windows, Router etc...).

Good Luck
User avatar
By gruf
AntalVincz wrote: Fri 17th February 2017, 15:20 Yes, SPA phones is tricky. :-)

I do not understand why not public is the master reset procedure.
So really just growing mountains of garbage.

did you ever get success with unlocking these phones?

I am in the same situation as others with several handsets (mostly spa514G) and do not want to add to the garbage recycling mountain.

I do not want to start on this project if you already found it was hopeless, but if you think there is any chance of success I would like to work with you to see what we can achieve.
User avatar
By AntalVincz

I don't found the solution to the SPA525.

But I developed the solution for SPA502, 504, 508, 509, 514, 303.
The solution covered if the phone factory reset is impossible, because the phone request the password.
And the phone customization is opened. The SPA502,4,8,9,14, 303 customization is closed rarely.




By Sponsor

Hi, I have a panasonic ip phone, so I want to impo…

Grandstream Assistance

@lusk @CJT-80 is correct, you should be u…

Delays in VoIP

Providing that the internet connection is good, th…

New VoIP set up query

1. If the 2 new members of staff wish to make ou…

Check out our Amazon top picks