Yealink T4x Series IP Phones - Disabling older SSL/TLS

[B Garfitt]

Hi

I have seen some older posts (2017) relating to disabling older SSL/TLS features for the web interfaces on the Yealink T4x Series IP Phones.

sip.tls_cipher_list = AES:!ADH:!LOW:!EXPORT:!NULL
security.tls_cipher_list = AES:!ADH:!LOW:!EXPORT:!NULL

However, I was wondering if there has been any more recent information concerning disabling these older connection methods (for vulnerability scanning) without resorting to editing the templates and thus making the system a minefield for 3CX support due to using custom templates. In a lot of cases, we VLAN off IP Phones on a network which resolves this issue, however, we have a couple of sites where VLANs are not able to be implemented as a solution here.

Is there a feature for restricting access on a Yealink T4x Series IP Phone from only a certain range of IP Addresses?

If updating the template to disable older ciphers is the only option here, then that is not a huge issue but I would like to avoid it if possible.

Thanks in advance

 

[NickD_3CX]

Hi!

Generally we get most of the template changes to the phone templates from the manufacturers.

Here though you are describing 2 different things:
1) Restricting access from only a certain range of IP Addresses
2) Disable older ciphers

For the #1, I don't happen to know if it's possible.
For #2, I think you should raise your concern with Yealink and if they deem it necessary, will provide us with an updated template.

Generally though I don't think we provision those parameters, which means that if you provision your Yealink from a Factory Reset state using the default template, those values should be the default.
This also means that if you manually make a change through the phone interface, reprovisioning the phone won't overwrite those settings.