Maybe intercept firmware update and then reverse engineer it and find rce?
The fw could be encrypted
military grade SSL
Seed is '123456', much more random than '4'