Polycom VVX factory reset

[E9876]

There was another string that was already posted about auto provisioning grabbing a configuration when it connects to the internet after it was factory reset so it sounds like if you do a factory reset it really is not factory reset because it can grab a configuration when it connects to the internet? This is a serious security issue. We have phones from other manufactures that did the same same thing and the party that the phone was repurposed to was able to access the original owners voice mails contact etc. How do you know if a Polycom VVX 450 will try to grab a provisioning config after factory reset?

[SteffenBaierUK]

Hello @E9876 ,

welcome back to the HP Poly community.

our publicly available VoIP FAQ contains:

Sep 19, 2022 Question: Why does a Phone return/revert to a previous unknown password even after a factory reset?

Resolution: If a phone is provisioned either by a local server/ZTP/LENS and/or a DHCP option the phone will simply load the old configuration.

On phones with access to the low-level GUI (option 4 >here<) once the password is reset either ZTP can be disabled or the Boot Server can be set to static. For phones that do not have such an option (CCX, Trio, D230, Rove or Edge E) please check with your IT team or whoever set up the phone.

A factory reset clears all configurations up until the point where a phone was provisioned by a previous owner or come into ownership of a new user from dubious sources and therefore still has a record from the previous customer.

The above includes phones specifically manufactured for a provider which have hardcoded URL's that cannot be reset.

I can only suggest you buy a brand new device or if these are 2nd hand work with whoever sold this prior to being used.

Best Regards

Steffen Baier

[E9876]

Thanks for all the links. It looks like most of the different reset options still holds the provisioning server config but what about formatting the file system. Is there any chance that it will still grab a config from the provisioning server if the files system is formatted? 

On another note is there a way to verify if the provisioning config is in the file system after doing a  factory resetting? I know just connecting it to the internet doesn't always provision the phone right away and can take some time. So not sure how to verify with out having to connect it to the internet over night or something like that?

[SteffenBaierUK]

Hello @E9876 ,

formatting the file system will only cause the phone to be required to re-load the software again most likely from a local server. After this it will follow the built-in logic.

For any follow-up questions I suggest you contact our Support organization in your region. Details are in my Signature.

Best Regards

Steffen Baier

[E9876]

Thanks for the reply. I'll see if anyone else in the community sees my second question about verifying if the auto provisioning config is in the file system after doing a factory resetting instead of connecting it to the internet and let it sit over night to see if it grabs a configuration. Moving forward purchasing new polycom phones as suggested wouldn't fix our data security needs and requirement's when we make more purchases as it does not resolve the issue when we get rid of them. On  side not in the Provisioning Server settings on there is an SIP Plug and Play that has PnP Provisioning Enable radio button. Not sure if enabling is what forces it to provision automatically if there is an auto provisioning config saved on the phone?

[SteffenBaierUK]

Hello @E9876 

I am unsure about your "data security" requirements but if you purchase a brand new phone, and do not register it to any of our Poly Cloud solutions like ZTP or Poly Lens, a factory reset at the end of its life, with no server that provides local or cloud-hosted configuration, will simply delete all data.

You brought up an example where a phone was used before, unsure of the origins of the phone, where it connected to a service previously used.

If the phone has been purchased from a legit source the original owner can delete all reference to the phone and therefore stop a phone from reaching previous configuration.

Best regards

Steffen Baier