I was playing with a 
Dynalink RTA 230 (http://www.dynalink.co.nz/products/rta230.htm), a linux 
based mips-cored adsl router. Looking at embedded linux system, i've found 
something like a backdoor:

# cat /etc/passwd
 admin:xxxxx(obscured)xxxxx:0:0:Administrator:/:/bin/sh
 userNotUsed:YNf8oSCwK/0/Y:0:0:Technical Support:/:/bin/sh

Then forced the pass with John:

root@sbongaz:~/john-1.6/run# ./john passwd -show
userNotUsed:userNotU:0:0:Technical Support:/:/bin/sh

the first user is the administration account also used by http config center; 
the second entry in passwd is not visible or modificable from the user config 
center. Luckly access to the http config center and telnet shell is blocked 
(not enabled by default) from outside the lan.

Many other adsl routers use the same chip/os, but 'ive no hardware to test it:
Us Robotics 9105 (without wireless) and 9106 (with wireless)
Siemens SE515 (to be confirmed)
Buffalo WMR-G54 (to be confirmed ; it might be a different chipset, but the 
firmware format looks the same)
 
For further references, take a look at 
http://skaya.enix.org/wiki/BroadCom96345