Solved Bricked Yealink T54W's with 96.86.0.20 firmware

[tenroc2o0o]

I just finished bricking 5x Yealink SIP-T54W's by installing the 96.86.0.20 update from either 96.85.0.5 or 96.86.0.5. 4x of them bricked after pushing the firmware via 3CX, and then one of them after using the phone's admin UI directly with the ROM downloaded from 3CX. I had 6x others that successfully updated. That's a 45% failure rate, in case anyone was counting.

The phones hang on "Welcome, Initializing.. Please wait". When I attempt to enter recovery mode by holding down the speakerphone button while power is applied, I'm unexpectedly greeted with a new menu that says "Whether to enter the recovery mode and run the backup system? 1) Yes 2) No". Pressing [1] just results in a hung black screen or a hung "Welcome" screen, whereas [2] doesn't do anything and locks the phone up afterwards.

This is different than previous firmware releases, where holding down the speakerphone button would prompt with two options, "1) TFTP 2) USB". Either option would allow you to load the recovery files (bin/rom/rfs). I'm unable to get to this point on these phones now after this failed firmware update.

I have a case open with Yealink and am waiting on their response.

Just thought I'd share, and maybe 3CX should consider retracting the firmware for T54W's.

As a side note, the same firmware image is also used on T53W's. I've had two phones fail to update - they get stuck in a firmware update loop where they hang at 93% while "downloading", and after rebooting the phone each time, 3CX re-triggers the same firmware update which then keeps hanging at 93%. However, I was able to enter recovery mode and restore those without any issue.

 

[acgomez76]

So I unfortunately did not see any of this and did the update through 3CX...went from .5 straight to .23. Fortunately, none of my phones bricked (I had 50 of them), however, the background image on the T54Ws are all distorted now. Anyone else having this issue?

 

[acgomez76]

Actually, it looks like what happened is that the new firmware doesn't like png files with transparent backgrounds. Once I added a background color to the png and re-uploaded to 3cx, the image looks fine now.

 

[cleanden]

I ran into the same issue with 54W's and 53W's. Opened a ticket with Yealink and they sent me an updated firmware version (96.86.0.21) which fixes the issues. You are able to hold the redial button when booting and load the new firmware from a USB.

Here is the link: [Link Removed]

Thanks for those files, but I must be missing something because whatever I try to flash from USB I get this error: Update failed (-1)

• I've tried formatting as FAT, FAT32, NTFS and exFAT
• I've tried both files named just as they download and also renamed as T54W.*

Any suggestions?

 

[digital58]

I was able to recover some phones from the 3 file method via TFTP.

I don't know what happened to another lot of phones, TFTP, USB, the 3 file combo or the 2 file combo will error out. The TFTP will fire back with that the rom file is too big.

It was only a handful out of 25 handsets that went bad, it would be nice to know what the reason was, for just some to go bad.

I have been following this thread for the last few weeks but I am to the point that I will need to contact Yealink directly.

Never will I ever upgrade firmware straight away again!

 

[JohnS_3CX]

Reminder for anyone coming just now to this thread, please make sure you read the entire conversation, especially the posts by Yealink staff with their instructions on what to do to upgrade, and what to do in case the upgrade does not work for you.

 

[Jeremy Bero]

Thanks for those files, but I must be missing something because whatever I try to flash from USB I get this error: Update failed (-1)

• I've tried formatting as FAT, FAT32, NTFS and exFAT
• I've tried both files named just as they download and also renamed as T54W.*

Any suggestions?

I get the same

 

[digital58]

Reminder for anyone coming just now to this thread, please make sure you read the entire conversation, especially the posts by Yealink staff with their instructions on what to do to upgrade, and what to do in case the upgrade does not work for you.

Thanks JohnS

Followed each reply to a T - Yealink support aren't able to give me working files - still have the 'file too large' issue.

Strongly considering RMA. I wish I could be more help to everyone who are stuck with the more stubborn T54 units.

 

[SweetAction]

@Lyman_Yealink I notice you are providing firmware files from Serv U file product (from the URL https://fileonline.yealink.com/ )
It is important you patch this software: https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211

 

[digital58]

Thanks JohnS

Followed each reply to a T - Yealink support aren't able to give me working files - still have the 'file too large' issue.

Strongly considering RMA. I wish I could be more help to everyone who are stuck with the more stubborn T54 units.

**UPDATE**

Yealink sent me new files - I honestly can't keep track of bin, rfs and rom files.

They wanted me to try with just two files a bin & rom. Which the rom is version 96.86.0.23.rom

[Link Removed]

1. Using TFTP, rename files to T54W.rom & T54W.bin.
2. Fire up the phone, load up your TFTP etc
3. Let it reject the rom being too large, let it transfer the bin file
4. Wait
5. You should see an initializing screen first then it should flick over to Upgrading Firmware and then you should see it bringing the rom file over then.
6. Wollah

I am not sure if previous files here had worked and I could of been impatient.

Hope it helps
Cheers

 

[Jeremy Bero]

**UPDATE**

Yealink sent me new files - I honestly can't keep track of bin, rfs and rom files.

They wanted me to try with just two files a bin & rom. Which the rom is version 96.86.0.23.rom

[Link Removed]

1. Using TFTP, rename files to T54W.rom & T54W.bin.
2. Fire up the phone, load up your TFTP etc
3. Let it reject the rom being too large, let it transfer the bin file
4. Wait
5. You should see an initializing screen first then it should flick over to Upgrading Firmware and then you should see it bringing the rom file over then.
6. Wollah

I am not sure if previous files here had worked and I could of been impatient.

Hope it helps
Cheers

My T54W doesn't do anything when pressing 1 for TFTP. 2- USB immediately errors to -1 code. Also, booting to a blank screen.

Has anyone been able to fix a phone that is booting to a blank screen instead of the “Welcome…Initializing…Please wait” screen?

Thanks!

EDIT:
Finally got TFTP to work. I wasn't pressing 1 vigorously enough I guess. Some of these T54W phones have a problem where you have to press certain keys pretty hard.

I'm still trying to find the right combination of files to work but at least it's doing something new.

 

[accentlogic]

**UPDATE**

Yealink sent me new files - I honestly can't keep track of bin, rfs and rom files.

They wanted me to try with just two files a bin & rom. Which the rom is version 96.86.0.23.rom

[Link Removed]

1. Using TFTP, rename files to T54W.rom & T54W.bin.
2. Fire up the phone, load up your TFTP etc
3. Let it reject the rom being too large, let it transfer the bin file
4. Wait
5. You should see an initializing screen first then it should flick over to Upgrading Firmware and then you should see it bringing the rom file over then.
6. Wollah

I am not sure if previous files here had worked and I could of been impatient.

Hope it helps
Cheers

This update worked on a couple of T53 units using the USB option. Files were renamed to T53.bin and T53.rom, insert the flash drive in the phone USB port, press and hold the Redial button, connect power and then press 2 when prompted for USB.

 

[digital58]

My T54W doesn't do anything when pressing 1 for TFTP. 2- USB immediately errors to -1 code. Also, booting to a blank screen.

Has anyone been able to fix a phone that is booting to a blank screen instead of the “Welcome…Initializing…Please wait” screen?

Thanks!

EDIT:
Finally got TFTP to work. I wasn't pressing 1 vigorously enough I guess. Some of these T54W phones have a problem where you have to press certain keys pretty hard.

I'm still trying to find the right combination of files to work but at least it's doing something new.

It's very strange, one of the 7 phones that died, did not accept the bin & rom combo, I had to put the RFS file in there as well and it worked!

I noticed something similar when trying to dial the IP address info in, it wouldn't register some numbers, but I didn't change how I was dialing numbers. I reckon it bugs out.

 

[rfcomms]

This update worked on a couple of T53 units using the USB option. Files were renamed to T53.bin and T53.rom, insert the flash drive in the phone USB port, press and hold the Redial button, connect power and then press 2 when prompted for USB.

Many thanks - worked on a T53W with just the rom and bin and renamed to T53W.

 

[Jeremy Bero]

This update worked on a couple of T53 units using the USB option. Files were renamed to T53.bin and T53.rom, insert the flash drive in the phone USB port, press and hold the Redial button, connect power and then press 2 when prompted for USB.

What TFTP server are you all using?

Tried PumpKIN, Solarwinds, TFTP64D - all file too large error from client.

Tried another USB drive and finally took. I guess it didn't like my 1st drive even though it was formatted FAT32 as recommended by Yealink.

If anyone has the immediate error on USB - try another drive.

 

[jestruch]

This seems like this will be a huge issue. Is there something 3cx can do to ensure the correct firmware path is taken? For example I have tons of phones on 96.86.0.5, the upgrade path should be 96.86.0.18 then 96.86.0.23 or the phones will be bricked. But in the 3cx console, it wants to upgrade the phones directly to 96.86.0.23 which will brick the phones. Can 3cx throw out a hot patch for this to ensure the correct path is taken? I feel like many people will not know about this and this will cause widespread headaches and annoyances.

 

[NickD_3CX]

This seems like this will be a huge issue. Is there something 3cx can do to ensure the correct firmware path is taken? For example I have tons of phones on 96.86.0.5, the upgrade path should be 96.86.0.18 then 96.86.0.23 or the phones will be bricked. But in the 3cx console, it wants to upgrade the phones directly to 96.86.0.23 which will brick the phones. Can 3cx throw out a hot patch for this to ensure the correct path is taken? I feel like many people will not know about this and this will cause widespread headaches and annoyances.

If you have T5x phones currently on 96.86.0.5, you can now safely upgrade them to the suggested 96.86.0.23.
The reason is that with the help of Yealink, we have uploaded a patch along with the .23 firmware, so the phone first reads the patch file, then the firmware file, and the upgrade goes smoothly.

I understand your hesitance if course, so try maybe one device only first, to see it, but it seems to have worked for a lot of users without any complaints so far that hadn't attempted to go to 96.86.0.20.

 

[paulkingston]

What’s really annoying is 3CX have not done anything to allow us to push the upgrade paths out. We need to manually go to each phone and do a sub upgrade before pushing the upgrade. .23 also isn’t available. I guess we should just brick our phones and then call 3CX for official support!!!! We really should be allowed to add firmware options to 3CX when these types of issues come up or they should support the ability to allow proper upgrade paths. I agree this is Yealinks stuff up but it is also something 3CX a could make easier for partners to rollout a step update, then the current update so we can do this on mass.

 

[accentlogic]

What’s really annoying is 3CX have not done anything to allow us to push the upgrade paths out. We need to manually go to each phone and do a sub upgrade before pushing the upgrade. .23 also isn’t available. I guess we should just brick our phones and then call 3CX for official support!!!! We really should be allowed to add firmware options to 3CX when these types of issues come up or they should support the ability to allow proper upgrade paths. I agree this is Yealinks stuff up but it is also something 3CX a could make easier for partners to rollout a step update, then the current update so we can do this on mass.

Paul - 3CX posted in this thread back on July 5 what they have done and how this will be corrected. When Yealink releases the next update you will be able to upgrade the phones on 96.86.0.20 from the console.

Hi everyone,

We just had a meeting today with Yealink regarding this matter.

As our contact from Yealink mentioned here, if any of your devices have been rendered unusable by the upgrade to 96.86.0.20, then please contact Yealink Support as mentioned in the aforementioned post.

Traditionally the files we get from Yealink are "General Release" material, but most of the times we get them before they hit the Yealink website.

Version 96.86.0.20 was meant to be the release version, but due to this issue, we worked with Yealink and within ~24 hours we had replaced it with 96.86.0.23.

Where we are right now:

• You have upgraded the T5xW device to 96.86.0.23 and it is working fine
  In this case, there is nothing to do.
  
  
• You have done nothing and you are still on 96.86.0.5
  In this case in the MC, you should now see a new firmware available (96.86.0.23) to which they can upgrade safely.
  
  
• You attempted to upgrade to 96.86.0.20 and the phone is unusable
  You need to contact Yealink Support for instructions on how to restore their phone to normal operation at https://ticket.yealink.com/ as explained by Yealink here.
  
  
• Customer upgraded their phone to 96.86.0.20 and the phone is working normally
  There are no actions required, if the upgrade was successful all is good.
  However, in the MC they will now still see a newer firmware available, 96.86.0.23.
  Unfortunately you will not be able to upgrade to this firmware via the MC, because in essence, 96.86.0.20 and 96.86.0.23 are the same apart from a small change in the ROM.
  This will be resolved when Yealink releases a newer firmware again, e.g. 96.86.0.30, in which case phone on both 96.86.0.20 and 96.86.0.23 will be able to upgrade normally to it.
  If this really annoys you, you should either contact Yealink for help, or, try installing 96.86.0.23 manually from the phone's web UI from here.

Any firmware we upload to our download server is hand-given to us by the IP Phone manufacturer and checked briefly by us as well that the upgrade is successful. Unfortunately all our testing T5xW devices upgrade to 96.86.0.20 without issue, hence why we did not detect this.

Yealink has informed us that they will be taking measures to avoid this from happening again.

 

[cleanden]

Paul - 3CX posted in this thread back on July 5 what they have done and how this will be corrected. When Yealink releases the next update you will be able to upgrade the phones on 96.86.0.20 from the console.

In the meantime, I have found that while pushing the Firmware from the 3CX interface doesn't appear to do anything, it does allow the firmware to successfully apply if you then follow up and update each phone from the phone's UI.

 

[Colorado VoIP]

we just went through this with an in-house phone of ours. once the recovery firmware was in the phone and it rebooted, the second it hit the system it would try to update again. hence causing a boot loop of heck with a bad firmware.

the trick is powering up the phone with a power adapter (DISABLE WIFI) and inject the recovery firmware in it. even if it says failed, we noticed it still took the file.

the phone will reboot and be stable cause it can't see the voip system, and then you can either factory default it or manually load the correct firmware into the phone. once done, re-provision on the system and Walla! back in business.