The funniest thing is that these access points have a patch to dropbear (an embedded SSH server, which is disabled by default) that ALWAYS enables blank passwords for the root account, though it'll drop you into a config tool, not a shell.
The default root password is, of course, blank...