Arris TG2492 (VM Super hub 3)

[emantec]

Adding to elbarto's post on enabling telnet you can do the following to bypass the pwod by setting the 'client' password (assuming the client is actually Virgin Media in this case).

In /nvram/6/1 set the following at address 0x1F7

BC AE 6A 68 38 32 4B 18

This will set the password to 'pwned' giving you access to the higher privileged shell (still need to work out how to break into busybox).