iCatch DVR password forgotten

Hi everybody,

I'm really fighting against my iCatch DVR: I've forgotten the admin password, only a low-privilege user without any chance to gain admin level permissions.

The device is an iCatch DVR-413DH, there are some photos in the attachments.

I've tried to reset it by removing the CMOS battery, nothing to do.

I used "codecalculator_2", "SuperPassword.exe", "time_pwd_1.1.exe" but nothing to do again.

I tried to enter with telnet on the console but only HTTP 80 and HTTPS 443 ports are open (!)

The onboard chip is a NEXTCHIP NVP1914.

I'm also trying to break the webpage login of the system, it reports "mini_httpd/1.19 19dec2003", I'm looking for exploits to gain an admin access and reset the admin password but I'm still looking for an applicable method.

Is there any other way to reset this damned DVR, as short circuit some pins on the board?

Or some other ways like SPI interface? I've noticed on the back panel an RS485 indication, maybe I can gain a low level access to the chip?

Thank you very much for reading all my post!

Best Regards

Marcello

UP...?