Crack configuration passwords

By default the encryption method is a MD5 Salt encryption. (Same as old Linux easyily recognized by $1$AAA$BBB where AAA is the Salt and BBB is the hash).
Therefor bruteforce is possible with tools like John or Hashcat (type 500).
Only when it is a hardware device (no VM) and that the FIPS Mode is enable, then it uses the default Master Key to encrypt passwords.