Interesting. I ran both the -passwd and passwd DES/DES128 hashes through HashCat and did not yield any results. How did you get the cleartext?
Another approach is to enable telnet/ssh, rebundle the firmware, flash, and then login with root credentials.
If you look at the raysharp_dvr it also...