Now you know why someone sold such unit.
Unfortunately, there is no documentation related to such mode as far as I know. In advance, no one but you and one russian guy has been affected by issue like it so far. And no one found solution.
So what we can do now ? You have access to WEB GUI, so the device have network connectivity. So it should be syslog&debug capable. Let enable syslog&debug (highest level) messages, configure syslog server on a computer (there are some even for Windows) and catch all messages issued during phone's boot. It may or may not reveal something important. I'm very interested to see this kind of log.
In the meantime, we can guess only. The phone may be in manufacturer's test mode because of:
1. special firmware in it
2. POST failed
3. manufacturers configuration data are damaged or erased
4. ordered by a jumper on motherboard
5. configured by vendor's secret command or specially crafted configuration file
Now about more about the cases.
- You claimed you replaced firmware in phone successfully, but it changed nothing. So special firmware seems not to be answer.
- Phone is broken - a failure has been detected during Power On Self Test causing phone to switch to this special mode. Bootstrap syslog messages may confirm this. In such case there's little you can do with it - the unit is just broken.
- I wish there's small area in the flash holding the device specific data - like serial number, device's private RSA key pair and so on. This area is persistent during the overall device's life - it's affected neither by configuration resets nor firmware upgrades. If such area or area content is not found during the boot (e.g. damaged or missing at all), the phone may start in manufacturer's mode. In such case there's little you can do with it. Only vendor know how to personalize particular device. It may be done by software procedure, but it may require the data to be write to the flash by special hardware (via JTAG connector, for example).
- There are jumpers on mainboard, but they are open as far as I know - and undocumented. So it all other possibilities become exhausted, you can open the device and play gave with jumpers. It you can inspect other unit of the same kind then compare the jumpers inside.
- You are out of luck - if turned on by secret command (or specially crafted configuration file), only secret command (or specially crafted configuration file) will turn it off. I'm almost sure the Cisco will not disclose it to you. I assume the "if in warranty, RMA it - it will be replaced, you are out of luck otherwise" response.
Because of all-zero's serial the [3] is my favorite. But remember - this comment is blind guessing game only.
You may call SMB Support Center and ask for help as well. I count such attempt as "no chance", but it costs almost nothing to try it. But if you wish to make me happy, catch the syslog&debug first, as suggested above ;-)
