Would anyone happen to know where the Web UI password is stored? Mine will not seem to reset to admin on a bricked HFW4100s. I have tried the reset button many times as well as flashed new update.img firmware via the serial TTL console but I can never get into the telnet or the config utility as I do not have the correct web ui password. All I can think of at this point it to find where the Web UI password may be stored to try and edit it, or maybe brute force it if it is a hash, but first I would have to find it and so far I haven't been able to.
P.S. Thanks so much OP for your post. It was extremely helpful in getting the TTL console access for me.