HELLO & WELCOME

[AntalVincz]

Hi,

And what's the solution if not showing the admin menu.

Just showing those :
Attendant Console Status basic | advanced

The phone is factory reseted.

Fw: 7.6.2

And what's this: Customization: Pending Licenses: None

Thank you any suggestion.

Tony

[WelshPaul]

Hi Tony,

I have come across this issue before and it's not good news i'm afraid...

In every past case it was because the IP phone was not a standard generic retail device. Do you have the box? Look on the box for the following product number: Cisco SPA525G2 RC SKU. The -RC sku's are a special sku for service provider customers to do a no touch configuration prior to install in a hosted mode. The phone will load a service provider specific configuration but since the phone is not assigned to a SP it cannot be configured. Basically the phone locked to a service provider!

Best option would be to return the phone for a refund or replacement.

[AntalVincz]

Thank You,

There is a phone with a serial port (3.3 Volt level).
There, you can enter a secret menu.
I analyze.

Tony

[WelshPaul]

The Cisco SPA phones are VERY secure and as far as I am aware, the eeprom also being secure does not allow direct access. I don't think anyone has managed hack/unlock a SPA IP phone using the JTAG method.

For the record, I don't think VoIP phones should be locked down to a single provider unless it's provided free of charge, on loan or leased by a service provide. It just adds to landfill waste. :-/

[AntalVincz]

Yes, SPA phones is tricky. :-)

I do not understand why not public is the master reset procedure.
So really just growing mountains of garbage.

In any case, the internal serial port can be tried.
Just be aware that 3.3 Volts serial adapter must be used.
Available on eBay. It also has.

The list of SPA 525 serial commands:

VOIP>> help
? - alias for 'help'
autoscr - run script from memory
base - print or set address offset
bbothcode - Burn a code.bin on the flash.
bcode - Burn a code.bin on the flash.
bdinfo - print Board Info structure
bhome - Burn home partition on the flash.
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
bubt - Burn an image on the Boot Flash.
chpart - change active partition
cmp - memory compare
cmpm - Compare Memory
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
echo - echo args to console
erase - erase FLASH memory
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
flinfo - print FLASH memory information
fsinfo - print information about filesystems
fsload - load binary file from a filesystem image
g - start application at cached address 'addr'(default addr 0x40000)
go - start application at address 'addr'
gstburn - write all files from USB file storage disk to flash.
gstload - enables the USB file storage gadget.
help - print online help
iminfo - print header information for application image
imls - list all images found in flash
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
ls - list files in a directory (default /)
md - memory display
mm - memory modify (auto-incrementing)
mtderase - Erase the whole partition.
mtdparts- define flash/nand partitions
mtest - simple RAM test
mw - memory write (fill)
nand - NAND sub-system
nboot - boot from NAND device
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sleep - delay execution for some time
tftpboot- boot image via network using TFTP protocol
version - print monitor version

The serial port parameter: 38400, N, 8, 1

The serial port PIN-s left to right:

GND, NC, RXD, TXD, NC

When after connected the serial port adapter to the phone pins, starting the terminal program (PUTTY or another).
Connecting the phone POE SW or 5Volt DC supply.
When booting the phone press ESC to step to secret menu.

I think this is the CPU bootloader menu.

The SPA 525 phones LAN range 192.168.0.x
The phone LAN interface set up automatically this range.
And the phone try connect the TFTP server 192.168.0.100 address if use the rarpboot or tftpboot command.

Similar to the serial port is SPA502 and 504 as well.

Tony

[Jose]

Hi Tony,

I am having trouble connecting to the SPA525G via putty through the serial port although I am not 100% sure I am connecting to the correct J-Tag pins. Am I correct in thinking it is the 5 pin header at the top of the board(J3) ?

Thanks

Jose

[AntalVincz]

Hi Jose,

I double checked this:

The serial port parameter: 38400, N, 8, 1

The serial port PIN-s left to right:

GND, NC, RXD, TXD, NC

And that is good.

Yes the five pin connector that is (J3).
Some time not install the pin connector. Don't worry, soldering some little wire to.

Connect

GND ---- > your USB/TTL adapter GND
RXD ---- > your USB/TTL adapter TXD
TXD -----> your USB/TTL adapter RXD

This is 38400, N, 8, 1 the default serial speed.
If possible change that.
If you look the PUTTY screen unknown characters try change the PUTTY serial port speed.

Actually I think if the phone customization status is pending or show provider name (for example Vodafone) just have one solution, the complete reflashing the phone.
Maybe use to the JTAG.

But of course necessary the all file, and more information for example the flash memory map.

Regards

Tony

[Jose]

Hi Tony

I have been successful in connecting now, but the phone is requesting the file SPA952.kernal which isnt in my firmware folder.

Thanks

Jose

[AntalVincz]

Hi Jose,

Wait patiently until the phone is fully booted.
If you connected to the serial port, you can tracking the fully boot process.
After the phone finished the boot process available the VOIP>> prompt.
The phone request the IP address, important your network have the DHCP server (Linux, Windows, Router etc...).

Good Luck

[Jose]

Hi Tony,

If I do not stop autoboot no VOIP>> prompt is available. If I stop autoboot and enter command tftpboot SPA952.kernal is requested, if the phone is left to fully boot I cannot enter this command.

Thanks

Jose

[Jose]

Sorry I mean to say if I do not stop autoboot the VOIP>> prompt is unavailable.

[gruf]

Yes, SPA phones is tricky. :-)

I do not understand why not public is the master reset procedure.
So really just growing mountains of garbage.
...

Hi,

did you ever get success with unlocking these phones?

I am in the same situation as others with several handsets (mostly spa514G) and do not want to add to the garbage recycling mountain.

I do not want to start on this project if you already found it was hopeless, but if you think there is any chance of success I would like to work with you to see what we can achieve.

[AntalVincz]

Hi,

I don't found the solution to the SPA525.

But I developed the solution for SPA502, 504, 508, 509, 514, 303.
The solution covered if the phone factory reset is impossible, because the phone request the password.
And the phone customization is opened. The SPA502,4,8,9,14, 303 customization is closed rarely.

Regards

Tony

[gruf]

Hi,

If you have a solution you can share for the 514G this would be very helpful and would save me a lot of time and a bunch of junk phones!
(Maybe private post if you think the information should not be public).
Thankyou.

[AntalVincz]

Send a private message for me.