enable telnet: http://192.168.1.1/getpage.gch?pid=1002&nextpage=tele_sec_tserver_t.gch

telnet user and password:

admin
chzhdpl@246

then type su command switch to root, password:

aDm8H%MdA

decrypt config:

sidbg 1 DB decry /userconfig/cfg/db_user_cfg.xml

then inspect decrypted config file at:

/tmp/debug-decry-cfg

https://github.com/douniwan5788/zte_modem_tools