VoIP hardware is developing fast - this is where you ask all those “how do I make my SIP Telephone, Adapter or Asterisk box work with my voip provider?” questions.


By Sponsor


By Sponsor
User avatar
By WelshPaul
You're both more than welcome to post about unlocking the devices in the topic at hand (that is if you want to). Other than maybe intercepting the provisioning request and pushing your own config file (used this method myself with Snom's), I don't see any other way? Anyway, good luck! :thumbsup:

So it looks like some Cisco phones can be unlocked using option 66, read more here

If that doesn't work, brute force may be the answer:
cisco spa phones does not have any protection against brute force attack, and it worked just fine on the test phone. 6 digits string rendered only 1 million combinations from 000000 to 999999. Simple c, perl, bash or php script was able to crack it under 4 hours given the time it took to send and receive a respond. Spa303 took little longer, I guess the cpu is slower.
I have some Cisco phones laying around and when I get the time, I will try out these methods.
User avatar
By WelshPaul
@edilson I very much doubt it. :dunno:
User avatar
By AntalVincz

The /fp file delete don't solve the locked customization problem.
Because the phone restarting and butting rebuild all file from image file.
The image file include the secret.
Some people able solve this.

If the phone is just password locked (the phone requesting the password for the factory reset) that is different problem and I able solve that, without brute force technique.


WelshPaul liked this
User avatar
By edilson
I read on some documentation that all SPA525 go to cisco.com to check if it is a customized equipment, if it is it will download a bin file to rebuild the firmware. So even if you are able crack the password it will redownload the customization. But if one deletes the "/home/fp" file and are able to reprogram the EEPROM with a different MAC and serial number that should fix the re-customization problem. I have successfully reprogrammed EEPROM on SPA504's.
On a side note, If you are able to reset SPA504 or SPA514 by other means please let me know.
Thank you


By Sponsor

Hello, It could be the SPA122 that's faulty, the …

VOIP JOB needed

This is an independent VoIP forum, we are not a Vo…

Newbie help!

I recommend Voipfone! They offer a pay go service …

Gigaset N300A IP

@VoipIT I doubt it. From my understanding ther…

Sign up for full membership