To open telnet (rj45) you need payloader to downgrade a firmware to telnet open port !
No way to hack the firmware to open telnet , firmware is protect by rsa128, the last 128 bytes of firmware block is the protection.
For my provider, i have payloader 7346 7358 and 1 more, I have telnet open...