Pretty sure this device can be flashed the same way the NR7101 can, in case none of the password retrieval methods work: Method to flash any NR7101
But note that this most likely writes to both firmware partitions like it does on the NR7101. So don't try unless you have some other way to get a copy of the original firmware. Or don't care about that...