Thanks for the steps, managed to flash a BR01 model with telnet disabled(2021/11). I did this without opening the case, the serial terminals can be reached by 3 short pins from outside.
