Maybe intercept firmware update and then reverse engineer it and find rce?

The fw could be encrypted

military grade SSL

Seed is '123456', much more random than '4'