@ryanc if you open it up and find the 8-pin SPI flash chip, there's usually a config block somewhere in there where there will be a bunch of copies of the configuration table with the passwords and stuff in cleartext. typically it's implemented as a circular buffer for wear levelling purposes, so each time you save persistent config it writes a new copy after the last, so you'll often get historical passwords from it too in case they reused any elsewhere.