Solved Yealink Phone constantly ringing with random extension numbers

[Scott EIT]

Hi

I have a Yealink T40G that is constantly ringing with random extension numbers such as "1001" "8080" etc
Whenever the phone is restarted/reprovisioned it keeps ringing with a call that does not show on 3cx or anywhere in the logs.

I have attempted factory resetting and deprovisioning both it and the router phone it is connected to ( the router phone is a Fanvil V62G and functions normally with no issues)

Any help or things to try and stop this phone ringing would be greatly appreciated

 

[paulodagraca]

Hello Scott EIT,

Be carefull, they are trying to hack your system
The best guess, is that you have a port 5060 open in your firewall, please CLOSE it ASAP !

Paulo

 

[CentrexJ]

Like Paulodagraca said, close 5060 on your firewall.

Additionally update to the latest T40G Firmware on the phone will help.

 

[Scott EIT]

Hello Scott EIT,

Be carefull, they are trying to hack your system
The best guess, is that you have a port 5060 open in your firewall, please CLOSE it ASAP !

Paulo

Like Paulodagraca said, close 5060 on your firewall.

Additionally update to the latest T40G Firmware on the phone will help.

Thanks for the reply

We have the latest firmware on the phone provided by 3cx.
The 3cx instance is hosted. would closing 5060 not affect the SIP traffic?

 

[leejor]

Yealinks have been know to receive Phantom calls..

A couple options you can change, depending on the firmware...

Go to the Features menu -> General Information -> Accept SIP trust server only
Scroll towards the bottom of the page (plus or minus the 6th option from the bottom, depending on the FW version)
Find the Accept SIP trust server only parameter and select enabled
Also...

Go to the Features menu -> General Information -> Allow IP call
Scroll towards the bottom of the page (plus or minus the 5th option from the bottom, depending on the FW version)
Find the Allow IP call parameter and select disabled


If Port 5060 is open, it is probably because 3CX is using it, Direct SIP to the set calls will have to reach the IP of the phone and their SIP port. This makes me suspicious that the phone is at a remote location and perhaps using STUN?

 

[CentrexJ]

5060 is likely opened on the lan where the phone is

 

[Scott EIT]

Yealinks have been know to receive Phantom calls..

A couple options you can change, depending on the firmware...

Go to the Features menu -> General Information -> Accept SIP trust server only
Scroll towards the bottom of the page (plus or minus the 6th option from the bottom, depending on the FW version)
Find the Accept SIP trust server only parameter and select enabled
Also...

Go to the Features menu -> General Information -> Allow IP call
Scroll towards the bottom of the page (plus or minus the 5th option from the bottom, depending on the FW version)
Find the Allow IP call parameter and select disabled


If Port 5060 is open, it is probably because 3CX is using it, Direct SIP to the set calls will have to reach the IP of the phone and their SIP port. This makes me suspicious that the phone is at a remote location and perhaps using STUN?

Thanks for this reply

Changing these settings and closing the port in the firewall has resolved this issue