Thanks for the info, the manual is different to my unit as it doesn't have the pigtail, and no sign of any internal button. Serial console could be an option, I already tried telnet, though none of the internet passwords worked, even using hydra to automate them.
In any case I can get...