Backup configuration file in http://192.168.10.1/pc/index.html#/settings/system/backup.
You will found an entry <TelnetEntry Active="No" telnet_username="CMCCAdmin" telnet_passwd="aDm8H%MdA" telnet_port="23" />
replace "No" with "Yes" and write it back to get telnet root shell.