VoIP hardware is developing fast - this is where you ask all those “how do I make my SIP Telephone, Adapter or Asterisk box work with my voip provider?” questions.
User avatar
By WelshPaul
Hi Tony,

I have come across this issue before and it's not good news i'm afraid...

In every past case it was because the IP phone was not a standard generic retail device. Do you have the box? Look on the box for the following product number: Cisco SPA525G2 RC SKU. The -RC sku's are a special sku for service provider customers to do a no touch configuration prior to install in a hosted mode. The phone will load a service provider specific configuration but since the phone is not assigned to a SP it cannot be configured. Basically the phone locked to a service provider!

Best option would be to return the phone for a refund or replacement.
User avatar
By WelshPaul
The Cisco SPA phones are VERY secure and as far as I am aware, the eeprom also being secure does not allow direct access. I don't think anyone has managed hack/unlock a SPA IP phone using the JTAG method.

For the record, I don't think VoIP phones should be locked down to a single provider unless it's provided free of charge, on loan or leased by a service provide. It just adds to landfill waste. :-/
User avatar
By AntalVincz
Yes, SPA phones is tricky. :-)

I do not understand why not public is the master reset procedure.
So really just growing mountains of garbage.

In any case, the internal serial port can be tried.
Just be aware that 3.3 Volts serial adapter must be used.
Available on eBay. It also has.

The list of SPA 525 serial commands:

VOIP>> help
? - alias for 'help'
autoscr - run script from memory
base - print or set address offset
bbothcode - Burn a code.bin on the flash.
bcode - Burn a code.bin on the flash.
bdinfo - print Board Info structure
bhome - Burn home partition on the flash.
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
bubt - Burn an image on the Boot Flash.
chpart - change active partition
cmp - memory compare
cmpm - Compare Memory
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
echo - echo args to console
erase - erase FLASH memory
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
flinfo - print FLASH memory information
fsinfo - print information about filesystems
fsload - load binary file from a filesystem image
g - start application at cached address 'addr'(default addr 0x40000)
go - start application at address 'addr'
gstburn - write all files from USB file storage disk to flash.
gstload - enables the USB file storage gadget.
help - print online help
iminfo - print header information for application image
imls - list all images found in flash
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
ls - list files in a directory (default /)
md - memory display
mm - memory modify (auto-incrementing)
mtderase - Erase the whole partition.
mtdparts- define flash/nand partitions
mtest - simple RAM test
mw - memory write (fill)
nand - NAND sub-system
nboot - boot from NAND device
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sleep - delay execution for some time
tftpboot- boot image via network using TFTP protocol
version - print monitor version

The serial port parameter: 38400, N, 8, 1

The serial port PIN-s left to right:


When after connected the serial port adapter to the phone pins, starting the terminal program (PUTTY or another).
Connecting the phone POE SW or 5Volt DC supply.
When booting the phone press ESC to step to secret menu.

I think this is the CPU bootloader menu.

The SPA 525 phones LAN range 192.168.0.x
The phone LAN interface set up automatically this range.
And the phone try connect the TFTP server address if use the rarpboot or tftpboot command.

Similar to the serial port is SPA502 and 504 as well.

Who is online

Users browsing this forum: CommonCrawl [Bot] and 0 guests

Landline bridge advice

Factory reset your OBi after updating it's firmwar…

Yep, good phones too! The Cisco SPA phones are na…

Hi Phil, Thanks for coming back to us and confirm…

Grandstream GXP1610 IP Phone

Description - Grandstream GXP 1610 IP Phone HD w…