The phone has a TM3260 processor (Philips Nexperia PNX1500 Media Processor SoC) (250 MHz, 130 nm) from 2002.
Entirely resetting the device is surprisingly complicated and requires an FTP server.
- Power cycle the device
- During the boot countdown press and hold down 6, 8, and *
- Then enter the MAC address in uppercase exactly as it is on the label on the underside of the device (no spaces). Note that this "emergency password" works only if the password dialog was entered in the way described
The phone then says:
- Resetting configuration, please wait.
- Configuration Reset.
- Uploading log file.
- Rebooting.
Then after the automatic reboot go into Setup. Now the password 456 works but only once.
We are not done yet!
In the phone main on-screen GUI, try to enter Advanced Settings. If you cannot enter Admin Settings, it means that we need to use a Provisioning Server to reset the phone completely. I am using an OpenWrt server for this. You could also run the FTP server on another system, but I had an OpenWrt system sitting right next to me anyways, and setting up an FTP server on it is straightforward.
On OpenWrt:
opkg update
opkg install vsftpd wget shadow-groupadd shadow-useradd unzip
# So that we can see what is going on on FTP, set in /etc/vsftpd.conf
syslog_enable=YES
xferlog_enable=YES
xferlog_file=/var/log/vsftpd.log
xferlog_std_format=YES
groupadd PlcmSpIp
useradd PlcmSpIp -g PlcmSpIp -p PlcmSpIp
May need to use all-lowercase group and user name plcmspip and then edit the following files manually or with sed to turn plcmspip into PlcmSpIp:
# /etc/group
# /etc/shadow
# /etc/passwd
# Change the password of user PlcmSpIp to PlcmSpIp
passwd PlcmSpIp
echo PlcmSpIp >> /etc/vsftpd/vsftpd.chroot_list
mkdir -p /home/PlcmSpIp
chown PlcmSpIp /home/PlcmSpIp
cd /home/PlcmSpIp
wget "https://community.polycom.com/polycom/attachm
ents/polycom/VoIP/526/1/ResetPassword.zip" --no-check-certificate
unzip ResetPassword.zip
# Verify:
# cat ResetPassword.cfg
# <device device.set="1">
# <auth device.auth.localAdminPassword.set="1" device.auth.localAdminPassword="456"/>
/etc/init.d/vsftpd restart
# Get the IP address with
ifconfig
In the phone's boot-time settings dialog enter:
- DHCP Client -> Enabled
- DHCP Menu -> Boot Server -> Static
- Server Menu -> Server Type -> FTP
- Server Address -> The address of the OpenWrt installation (* key has the . character when switched to letters)
- Exit, Save & Reboot
The phone says:
- Uploading log file.
- Rebooting.
- Waiting for network to initialize…
- Welcome!
- Processing configuration…
- This may take a few seconds
WORKS. I can now use:
Settings -> Advanced... -> 456 -> Admin Settings... -> Reset to Default... -> Format File System... -> Yes
Only now is the Factory Reset complete.
A slightly different way to do this is described at http://jonathanmanning.com/2014/09/11/how-to-reset-lost-password-on-polycom-vvx-ip-phone/.
Interestingly, the phone does not only read from but also write to the FTP server, e.g., log files and configurations. Do not use -phone.cfg for any new configuration files. This is the name of the configuration override file generated by the phone when the user changes a setting such as the preferred ring type.
cat /var/log/vsftpd.log on the OpenWrt system shows which files the phones is trying to access.
For example, the phone tries to download <...>-directory.xml.
To learn more about configuration, see http://www.polycom.com/common/documents/whitepapers/configuration_file_management_on_soundpoint_ip_phones.pdf
Note: In order to upgrade phone firmware from the OpenWrt FTP server, it may be desirable to mount a USB stick containing the firmware and using a command along the lines of
mount /dev/sdb1 /mnt -ouid=1000,gid=1000
In my example, I am using /mnt/polycom/ as the directory that gets served to the user PlcmSpIp. For this to work, I need to set up the /mnt/polycom/ directory as the home directory for the user PlcmSpIp.
In that directory on the OpenWrt server, do:
wget "https://downloads.polycom.com/voice/voip/uc/Polycom-UC-Software-4.0.14-rts26-G-release-sig-combined.zip" --no-check-certificate
wget "https://downloads.polycom.com/voice/voip/uc/polycom-uc-updater-5-0-14-rts5-release-sig.zip" --no-check-certificate
unzip Polycom-UC-Software-4.0.14-rts26-G-release-sig-combined.zip
unzip polycom-uc-updater-5-0-14-rts5-release-sig.zip
Reboot the phone. It should pull the update and install it. However, cat /mnt/polycom/*.log shows that this results in:
1228172149|cfg |3|00|Downloaded application image is incompatible
1228172149|app1 |4|00|Application sip.ld is not compatible with the phone.
The new "bootrom" (now called "updater") is not even tried to be loaded from FTP as cat /var/log/vsftpd.log shows:
Sat Dec 28 17:21:08 2019 1 192.168.178.82 0 /mnt/polycom/3111-15600-001.bootrom.ld b _ o r PlcmSpIp ftp 0 * i
Sat Dec 28 17:21:08 2019 1 192.168.178.82 0 /mnt/polycom/bootrom.ld b _ o r PlcmSpIp ftp 0 * i
Sat Dec 28 17:21:08 2019 1 192.168.178.82 0 /mnt/polycom/0004xxxxxxxx.cfg b _ o r PlcmSpIp ftp 0 * i
Sat Dec 28 17:21:08 2019 1 192.168.178.82 1699 /mnt/polycom/000000000000.cfg b _ o r PlcmSpIp ftp 0 * c
Sat Dec 28 17:21:08 2019 1 192.168.178.82 0 /mnt/polycom/3111-15600-001.sip.ld b _ o r PlcmSpIp ftp 0 * i
Sat Dec 28 17:21:48 2019 40 192.168.178.82 149970632 /mnt/polycom/sip.ld b _ o r PlcmSpIp ftp 0 * i
Sat Dec 28 17:21:58 2019 1 192.168.178.82 12222 /mnt/polycom/0004xxxxxxxx-boot.log b _ i r PlcmSpIp ftp 0 * c
Sat Dec 28 17:22:13 2019 1 192.168.178.82 0 /mnt/polycom/3111-15600-001.bootrom.ld b _ o r PlcmSpIp ftp 0 * i
Sat Dec 28 17:22:13 2019 1 192.168.178.82 0 /mnt/polycom/bootrom.ld b _ o r PlcmSpIp ftp 0 * i
Sat Dec 28 17:22:13 2019 1 192.168.178.82 0 /mnt/polycom/0004xxxxxxxx.cfg b _ o r PlcmSpIp ftp 0 * i
Sat Dec 28 17:22:13 2019 1 192.168.178.82 1699 /mnt/polycom/000000000000.cfg b _ o r PlcmSpIp ftp 0 * c
Sat Dec 28 17:22:13 2019 1 192.168.178.82 0 /mnt/polycom/3111-15600-001.sip.ld b _ o r PlcmSpIp ftp 0 * i
Sat Dec 28 17:23:06 2019 53 192.168.178.82 149972936 /mnt/polycom/sip.ld b _ o r PlcmSpIp ftp 0 * i
Sat Dec 28 17:23:32 2019 1 192.168.178.82 0 /mnt/polycom/0004xxxxxxxx-phone.cfg b _ o r PlcmSpIp ftp 0 * i
Sat Dec 28 17:23:34 2019 1 192.168.178.82 0 /mnt/polycom/000000000000-license.cfg b _ o r PlcmSpIp ftp 0 * i
Sat Dec 28 17:23:34 2019 1 192.168.178.82 0 /mnt/polycom/0004xxxxxxxx-license.cfg b _ o r PlcmSpIp ftp 0 * i
Sat Dec 28 17:23:34 2019 1 192.168.178.82 0 /mnt/polycom/0004xxxxxxxx-directory.xml b _ o r PlcmSpIp ftp 0 * i
Sat Dec 28 17:23:36 2019 1 192.168.178.82 19258 /mnt/polycom/0004xxxxxxxx-app.log b _ i r PlcmSpIp ftp 0 * c
Sat Dec 28 17:24:39 2019 1 192.168.178.82 32278 /mnt/polycom/0004xxxxxxxx-app.log b _ i r PlcmSpIp ftp 0 * c
Whereas I have:
root@OpenWrt:/mnt/polycom# ls /mnt/polycom/*updater*
/mnt/polycom/3111-15600-001.updater.ld
/mnt/polycom/3111-40000-001.updater.ld
/mnt/polycom/updater.ld
Possibly it would be sufficient to just also put http://ftp.tecnoera.com/polycom/4.0.1/3111-15600-001.bootrom.ld there and be done with it? (If you test this, please let me know in the comments below.)
Instead I (successfully) tried update to 3.3.2 and then to 4:
wget "https://downloads.polycom.com/voice/voip/uc/UC_Software_3_3_2_release_sig_combined.zip" --no-check-certificate
unzip UC_Software_3_3_2_release_sig_combined.zip
reboot the phone
###
Originally on the phone was:
Bootblock 2.8.0_15600-001.0016
BootROM 4.1.2.0037 (from 2008) is installed
SIP 3.1.3.0439
###
Updated to: UC_Software_3_3_2_release_sig_combined.zip
Now on the phone:
3.3.2.0413 11-Aug-11 14:26
###
wget https://downloads.polycom.com/voice/voip/uc/Polycom_UC_Software_3_3_5_release_sig_combined.zip --no-check-certificate
unzip Polycom_UC_Software_3_3_5_release_sig_combined.zip
mv Polycom\ UC\ Software\ 3.3.5\ rts8\ release\ sig\ combined/* .
# Reboot the phone
# Now on the phone:
# 3.3.5.0247 11-Dec-12 03:54
###
wget https://downloads.polycom.com/voice/voip/uc/UC_Software_4_0_1_release_sig_combined.zip --no-check-certificate
unzip UC_Software_4_0_1_release_sig_combined.zip
# I do not seem to have this from official sources...
wget http://ftp.tecnoera.com/polycom/4.0.1/3111-15600-001.bootrom.ld
# Reboot the phone
# says
# Updating BootROM, please wait.
# Formatting file system, please wait.
# Phone reboots
# Saving new bootROM...
#
1228184747|cfg |3|00|Recognized bootROM
1228184748|cfg |3|00|Using compatible image 1
1228184748|copy |3|00|Download of '3111-15600-001.bootrom.ld' succeeded on attempt 1 (addr 1 of 1)
1228184748|sig |4|00|Initial log entry
1228184748|sig |3|00|hwSigParseRemove: found key Sig_3.
1228184748|cfg |3|00|Good image signature
# Looks like it is flashing this whenever it exists,
so removing it after successful flash
rm 3111-15600-001.bootrom.ld
# Saving new application...
# Now on the phone:
# 4.0.1.13681 29-Nov-11 17:51
wget "https://downloads.polycom.com/voice/voip/uc/Polycom-UC-Software-4.0.14-rts26-G-release-sig-combined.zip" --no-check-certificate
wget "https://downloads.polycom.com/voice/voip/uc/polycom-uc-updater-5-0-14-rts5-release-sig.zip" --no-check-certificate
unzip Polycom-UC-Software-4.0.14-rts26-G-release-sig-combined.zip
unzip polycom-uc-updater-5-0-14-rts5-release-sig.zip
# Saving new Updater...
# Reboots
# formatting file system, Please wait.
# Phone now has:
# 4.0.14.1580 13-Jul-19 17:24
# This is currently the latest
Now I can successfully log into the web interface
using Admin/456 using Chrome (Firefox gives an error: "Authorization failed. The page is here.").
To have a directory softkey on the home screen instead of a forwarding key, edit 0004xxxxxxxx-web.cfg on the FTP server (the phone should have created it after you have used the web interface). Add the following lines:
feature.enhancedFeatureKeys.enabled="1"
softkey.feature.forward="0"
softkey.feature.directories="1"
Select "update configuration" from the settings menu on the phone to pull the updated settings without a restart of the phone.