Lightwave ConsoleServer 800
The ConsoleServer 800 is your basic serial console server. It has several serial ports for hooking up to serial console ports on your servers or network devices, and has both a serial terminal port and an ethernet port for your remote access to these consoles. It is likely that information here will be relevant for other units from the same product line, as they probably differ on little besides port count.
(I apologize if this section is poorly written. It was quickly thrown together and never cleaned up.)
What is unique about the CS800, is that there is no easy way to reset a lost administrative account (called "root") password on the device. There is no magic jumper, battery, capacitor, or anything like that. The configuration is stored in non-volatile memory, and there is no simple reset method. However, no one ever said the actual guts of the CS800 were difficult to decipher.
In essence, the CS800 is based around a common Motorola 32-bit microcontroller known as the MC68332. This chip has a nifty feature called "background debug mode". With this feature, more commonly just called “BDM”, the chip can provide a runtime debugger interface. Now, here’s the best part… The nice folks at Lightwave placed a pin header on the circuit board of the CS800, and clearly labeled it "BDM".
To use this special port, you need a BDM interface. You could spend a few hundred on a commercial one. However, Motorola provides schematics and software for a cheap and easy-to-build one.
You can find the schematics for this BDM pod in application note AN1230.
With this unit, you can talk to the BDM port with the parallel port of a normal PC and Motorola’s little DOS-based program known as BD32.
Once you have this all up and running, you will be able to view the contents of any arbitrary memory address on the CS800. Look around address "$121740", and you will find the root password stored in plain-text. Use this to log in normally as root, and change the password to whatever you feel like.