OK - it's late - but something interesting appeared

 

Attempts at inspecting the config

 

From telnet session, and looking at directory like strings in the openrg binary, there's a login & password. 

 

• conf

• print cwmp

 

Initial inspection shows

• a URL for  <MY_IP>:4567

• a username & password  ( possibly encoded ? )

• what appear to be callbacks to verizon (perhaps extra security?)

• default gateways

• all the wireless keys

 

Also (from the conf submenu) there's probably a lot more (let me know)

• print InternetGatewayDevice

• print fw

• print system

• print wbm

• print admin

• print rmt_upd

• print rip

• print manufacturer

• print mcast

• print igmp_proxy