What you need to solve truly clear the phones:
A PC with a free NIC which is set with a fixed IP Address, the address is of no importance yet.
Wireshark installed
A tftp/dhcp server like TFTP32
A POE injector
Start up the PC. start tftp32 and configure it as a DHCP server on the free LAN
start wireshark and capture all off the free NIC
attach a lan cable between the free NIC and the network connector of the (powered on) POE injector
attach a lan cable to a IP Phone and see if it gets a IP Address from TFTP32
if it gets a IP address from TFTP then note the address
look at the wireshark captured packets and filter on the phone MAC address
look if it does a tftp request and to which ip address
assign your free NIC a ip address in the same subnet as the phone tries to get a file from the tftp server
reconfigure tftp32 to be a dhcp server and a tftp server in that segment and have a 46xxsettings.txt \file in the tftp root
in the file the line "SET OPSTAT 111" ,"SET PROCSTAT 0" and SET PROCPSWD 572958"
There may not be dashes before the lines, the admin password will be "CRAFT"
reboot the phone and make sure it loads the 46xxsettings.txt file
wait until it shows "finding router"
restart the phone and the "press * to configure" will appear while booting
Press * and use "CRAFT" (572958) as the password
then repeatingly press # until the message "enter command" appears
press the MUTE button followed by "CRAFTCLEAR" and confirm twice by pressing #
the phone will reboot with factory settings loaded
congratulations, you have a phone you can configure as if it was a brand new one.