The third-party apps exploit a hole in the ITL logic to do this: the phone will continue using the most recent XML file it saved to flash that was digitally signed by a member of the ITL it also has saved in flash memory. That XML file has the IP/DNS FQDN of the CUCM nodes it was supposed to register to. After it rejects the newer XML file for failing the digital signature check, it attempts to register to the CUCM nodes defined in the local file.
IF it can register successful then there is an opening for the third-party apps to exploit: you can pass XML SDK commands over CTI to CUCM (assuming the Application User of the CTI-connected application has control over the phone). CTI Manager will relay these commands to the phone, which bypasses the Authentication URL and ITL/TVS. Same commands, just a different approach vector.
The caveat of this approach is that the phone must register to CUCM using the IP/DNS FQDN in it's local flash. If it cannot do this then you have no method to do this remotely.
This is where I pass you off to DevNet as Jaime suggested. You would need to write a program that leverages CTI and the phone XML SDK. Good luck!
