Here's how to unlock the userspace login prompt and the recovery TftpServer, once you have a SerialPort attached and have managed to UnlockTheConsole:

At the U-Boot console, type:

  setenv shadow_data admin:XkRnx5gdf6RdQ:0:0:99999:7:::
  setenv sync_to_pt enable
  reset

This will boot the device with the protected admin password permanently reset to 'admin'.

The following log is new on the console during the first reboot after the above commands are executed:

 Env Version[0.1]
 Env [sync_to_pt] Deleted
 ..
 done
 *write PT Env, checksum[64] env[ethaddr=00:21:29:09:6B:8D] addr[fffc0000]
 *write PT Env, checksum[54] env[eth1addr=00:21:29:09:6B:8E] addr[fffc0108]
 write PT Env, checksum[b] env[wlanaddr=00:21:29:09:6B:8F] addr[fffc0210]
 write PT Env, checksum[4d] env[wlan1addr=00:21:29:09:6B:90] addr[fffc0318]
 write PT Env, checksum[63] env[shadow_data=admin:XkRnx5gdf6RdQ:0:0:99999:7:::] addr[fffc0420]
 write PT Env, checksum[72] env[crypt_key=D78E04DFB7F1A93E8EB10C39DC8AD6182ED774584A78174BA7554EA79ECCB064] addr[fffc0528]
 write PT Env, checksum[6b] env[model_name=WRP400] addr[fffc0630]
 write PT Env, checksum[65] env[wps_pin=22367600] addr[fffc0738]
 write PT Env, checksum[b] env[serial_number=CR301H600315] addr[fffc0840]
 write PT Env, checksum[6d] env[hash_dir=6b9dbU3PGx] addr[fffc0948]
 write PT Env, checksum[3a] env[admin_pwd=AB0ZMEshjN6eY] addr[fffc0a50]