My linux box is offline but going by my previous few posts...
1) Using ejs defaultconfig.dec.xml, from the zip in the second post in this thread, delete lines 1061 to 2104 (The voice services section)
2) Add the following after line 5
<DeviceInfo>
<ManufacturerOUI val=2158/>
<SerialNumber val=2158-xxxxxxxxxx/>
<HardwareVersion val="TD-W9970 v1 00000000"/>
<SoftwareVersion val="0.9.1 2.5 v0025.0 Build 150831 Rel.61883n"/>
<X-TP_DevManufacturerURL val="http://www.tp-link.com" />
<Description val="Modem Router`telnetd -p 1023 -l login`" />
</DeviceInfo>
Where 2158 is the first part of the serial number .....and xxxxxxxxxx is the second part.
Hardware version should be the same (can be copied off the web interface)
Software version is copied and pasted off the web interface.
3) Save then encrypt with StatPOSTer-test2.jar (ejs' java program)
http://forum.kitz.co.uk/index.php/topic,17108.msg315223.html#msg3152234) Upload via the web GUI.
After a reboot the GUI will look like the attachment and a telnet daemon on 192.168.1.1:1023 will be available.
If this does not work I will connect up my linux box tomorrow afternoon sometime and upload my xml and bin files.
Ian
EDIT: add location of defaultconfig.dec.xml file.
Edit 2 : Update the version of ejs java statsposter program.