Protection against SIP vicious on wp52 and above

[pgtipicall]

(02-16-2015 04:47 PM)saulgoodwin Wrote:  Hi kids,

Just a quick note.
In the latest Yealink Firmware there is an option Accept Sip Trust Server Only. By default it is set to Diabled.
Try changing it to Enabled.
You can find the option under Accounts -> Advanced.
It is at the very bottom of the list.

Tested on T20, T21, T26.

Hope that helps.

So I installed a SIP Vicious on a Raspberry Pi and ran a scan on our local network and discovered all Yealink phones, sent a blank invite to a device and it rang.

Easy when you are in the internal network, my colleague changed a setting on his phone and it now no longer rings.

Surely the issue here is that the device connecting the phones to the service is not secure? If it's locked down to a specific IP then it should not be a problem?