Bought some used hardware on eBay. Factory reset didn't work. Wasn't able to get in with admin/admin.
So, I desoldered the flash chip, replaced it with a ZIF socket, dumped it, and pointed John the Ripper at /etc/shadow.
Password was "admin", but username was "agcfw".
Sometimes obscurity works!