Cisco SPA508G

[monchycastro]

Hi there

I bought a Cisco Phone SPA508G from Cox Business amazon store and the phone is blocked by Admin password. I try to connect with Cox Business and they don't offer support to non customers. I can't return this phone because the time expired. I need to restore by factory reset  in order to supply the new provisioning but I can't do it by setting. I need help. 

All the Best

[Dan Lukes]

Check VID-PID on the bottom of the phone. If it contains letters "RC" you bought OEM unit (unit customized for particular customer). You can't revert it to the retail unit even by reset to factory default - because the factory default values are customized as well.

[monchycastro]

Thanks for your replay.. nop, VID-PID dont appear RC.... exactly ...SPA508G V03

[Dan Lukes]

So far so good. Unfortunately, even retail unit can be locked the way that unauthorized user can't reset it to factory default. Unauthorized user is the user who knows no admin password. It seems to be your case.

So only question that needs to be answered is - is reset to factory default password protected on your unit ?

Describe the steps you are doing in attempt to reset to factory default and disclose the phone's responses.

Note that reset to factory default can be initiated locally (from phone's menu) only. There's no way to initiate it thru WWW UI.

[monchycastro]

Hi Dan

Yes, Reset to Factory default is protected by admin password. I'm trying from phone menu... I'm working with those phone long time ago. I saw in some forum that connecting by TFTP and mekae some change its possible reset the admin password... but really ,, I don't try... let me know if you know other way, All the Best

[Dan Lukes]

So you are trying to break phone lock configured by authorized administrator.

Well, it may or may not be possible. It depend on the current configuration, firmware version - and your hacking skills.

Phone is configured to fetch configuration from somewhere. Capture network packets (including DNS questions and answers) to identify the provisioning source. Then try to cheat the phone - provide fake DNS and/or manipulate network environment to trick phone to fetch configuration from your server instead.