Update: After googling found a hash passwd file on someone blog
Running John for 4 days, finnaly....today i got root password for telnet access, from telnet i can read the config
[root@GM]# cat /opt/sav/Config/passwd
#
# UGM 1.2
# id:name:passwd:lawspwds:groupid:authority:memo:share
#
1:admin:v8lXXLjz:1001:1:CtrPanel, ShutDown, Monitor, Monitor_01, Monitor_02, Monitor_03, Monitor_04, Monitor_05, Monitor_06, Monitor_07, Monitor_08, Replay, Replay_01, Replay_02, Replay_03, Replay_04, Replay_05, Replay_06, Replay_07, Replay_08, NetPreview, NetPreview_01, NetPreview_02, NetPreview_03, NetPreview_04, NetPreview_05, NetPreview_06, NetPreview_07, NetPreview_08, Record, Backup, MHardisk, MPTZ, Account, Sysinfo, Alarm, Config, QueryLog, DelLog, SysUpdate, Control, AutoMaintain, GeneralConf, EncodeConf, RecordConf, ComConf, NetConf, AlarmConf, VideoConfig, PtzConfig, OutputConfig, DefaultConfig, DataFormat:admin 's account:1
2:user:tlJwpbo6::2:CtrPanel, Monitor, Monitor_01, Monitor_02, Monitor_03, Monitor_04, Monitor_05, Monitor_06, Monitor_07, Monitor_08, NetPreview, NetPreview_01, NetPreview_02, NetPreview_03, NetPreview_04, NetPreview_05, NetPreview_06, NetPreview_07, NetPreview_08, Replay, Replay_01, Replay_02, Replay_03, Replay_04, Replay_05, Replay_06, Replay_07, Replay_08:user(user)'s account:0
3:default:1cDuLJ7c:86839164:2:Monitor, Monitor_01, Monitor_02, Monitor_03, Monitor_04, Monitor_05, Monitor_06, Monitor_07, Monitor_08, NetPreview, NetPreview_01, NetPreview_02, NetPreview_03, NetPreview_04, NetPreview_05, NetPreview_06, NetPreview_07, NetPreview_08:default account:0
4:support:cPZZ9Jkf:myown:1:CtrPanel, ShutDown, Monitor, Monitor_01, Monitor_02, Monitor_03, Monitor_04, Monitor_05, Monitor_06, Monitor_07, Monitor_08, Replay, Replay_01, Replay_02, Replay_03, Replay_04, Replay_05, Replay_06, Replay_07, Replay_08, NetPreview, NetPreview_01, NetPreview_02, NetPreview_03, NetPreview_04, NetPreview_05, NetPreview_06, NetPreview_07, NetPreview_08, Record, Backup, MHardisk, MPTZ, Sysinfo, Alarm, Config, QueryLog, DelLog, SysUpdate, Control, AutoMaintain, GeneralConf, EncodeConf, RecordConf, ComConf, NetConf, AlarmConf, VideoConfig, PtzConfig, OutputConfig, DefaultConfig, DataFormat:Remote Support:1