Well, I was hoping for one of the Atheros models, strangely enough, but I landed one of these instead. I'm presently on the hunt for any trick to gain access without opening the case. (Too lazy to solder, up for the challenge...)
So far, it's obvious that it's listening on port 23 by default (though rejecting telnet connections), and that netgear.cfg contains many environment variables used by the vxWorks preload and associated software.
It's also obvious that there are quite a few CGI scripts present to handle the interface... and perhaps even some 'secret' ones or options thereto, judging by other Netgear products?
So... While I'll continue to poke and prod, may I ask anyone who *has* gotten in via the serial method to provide some hint of what's present? Is it possible to get something like a ls -R of the filesystem? Some hint of what's /reading/ those nvram variables would be nice.... (Could telnet access be as easy as a shell ` ` injection? ... Is there even a real telnetd present in the ROM?)