How to unbrick a Cisco 7912 Series IP Phone

Out of the blue this morning, my phone was stuck with a blank screen and the red and green lights stuck on. No buttons did anything and rebooting the phone (via unplugging it) simply returned the phone to the solid red and green lights.

After some digging around, I found the following process to be successful:

You will need:

• A Windows computer with an Ethernet port
• A Cross over Ethernet cable or a spare Ethernet Switch or Hub
• A Broken 7912
• A Power Pack for 7912 (not a PoE switch or Ethernet power injector)
• A Copy of TFTPd32 http://tftpd32.jounin.net/tftpd32_download.html

Follow these steps exactly:
1: Disconnect the computer from your current network

2a: Connect cross over cable to the computer and switch port of the phone
~or~
2b: If you are using a switch or hub, connect both devices to the switch or hub, but they should be the only devices connected

3: Configure a static IP on the computer and disable any firewall.
3a: Use an IP of 192.168.1.1
3b: Use a Mask of 255.255.255.0
3c: Gateway and DNS can be left blank

4: Install and open TFTPd32 software

5: Click settings and modify the following:
5a: In the GLOBAL tab, uncheck everything except TFTP Server and DHCP Server
5b: In the TFTP tab, set a Base Directory to somewhere convenient
5c: In the TFTP tab, set TFTP Security to None
5d: in the DHCP tab uncheck all DHCP Options

6: Restart TFTPd32

7: Click on the settings tab and modify the following:
7a: In the DHCP tab, set IP pool starting address to 192.168.1.2, size of pool 1, mask 255.255.255.0, additional option 66 and 192.168.1.1, then click OK

8. Click on the Log viewer tab

9: Plug in the power of the phone and watch the logs.

You should see something like this:

Rcvd DHCP Discover Msg for IP 0.0.0.0, Mac 00:11:BB:0D:E7:AE [01/08 16:20:58.093]
Client requested address 0.0.0.0 [01/08 16:20:58.093]
DHCP: proposed address 192.168.1.2 [01/08 16:20:58.093]
3300 Request 2 not processed [01/08 16:20:58.113]
Rcvd DHCP Rqst Msg for IP 0.0.0.0, Mac 00:11:BB:0D:E7:AE [01/08 16:20:58.113]
Previously allocated address 192.168.1.2 acked [01/08 16:20:58.113]
3300 Request 2 not processed [01/08 16:20:58.134]
Connection received from 192.168.1.2 on port 16156 [01/08 16:20:58.144]
Read request for file (cp7912r.zup). Mode octet [01/08 16:20:58.144]
File (cp7912r.zup) : error 2 in system call CreateFile The system cannot find the file specified. [01/08 16:20:58.144]

You can see that it is looking for a file called cp7912r.zup. If you don't get to this point, go back to step 7a and use option 150 instead of 66.

Now for the difficult part. You need to get this file from somewhere. It turns out that if you manage to get a file called CP7912080001SIP060412A.sbin  you can simply rename it to cp7912r.zup and put it into the base directory (step 5b above).  If you do this successfully, the log will look like this:


Connection received from 192.168.1.2 on port 16157 [01/08 16:22:52.288]
Read request for file (cp7912r.zup). Mode octet [01/08 16:22:52.288]
Using local port 1251 [01/08 16:22:52.298]
(cp7912r.zup): sent 655 blks, 335194 bytes in 13 s. 0 blk resent [01/08 16:23:05.396]

This will indicate success and you will see the phone reboot. In my case, the phone completely went back to normal without loosing any of its prior settings.

So really the hardest part of this is to find the .sbin file mentioned above. As a hint of where to get it, do a Google search for CP7912080001SIP060412A.zip which is an archive that contains this magic file.