I dumped the FW of Sercomm (ADT) DBC835 Doorbell I think there only one FW exists, the internals are really interesting, it has even OpenVPN that's run on it and ton of apps. but they changed default administrator blank pass now it want's the password, shadow sends to null and didn't find any other place except config file that has it in AES.