telnetd, the server, is missing from that firmware, so you would need to add it from elsewhere.
The (big-endian) root file system is packed using mksquashfs version 3.3 and lzma compression.
Also missing is xdslcmd. That is the userspace tool needed to tweak the target SNRM.
So both those programs - telnetd and xdslcmd - would need to be added.
The file system is then compressed and re-packed and the Linux kernel image concatenated.
Add a header to convert it to a standard broadcom firmware image (or perhaps a special TP-Link image)
Flash back in, and hope for the best!
Unless the device is special in some way, (6338 chipset is quite old..) all that might not be worth the effort.
You would also need UART/JTAG access to do it, if available.
No one has taken PCB photos of that device yet, so people (e.g. me) would be interested in them!
cheers, a
P.S. Incidentally, it seems that TP-Link chops and changes its chipsets through every major revision. The 8950 is a Broadcom 6338, the 8960 is also Broadcom, and yet the 8970 is a Lantiq and then the 8980 is a MediaTek (was Ralink) (was Trend).
Curiously, it turns out that the Lantiq in the 8970 is a multimode comms processor capable of both ADSL2+ and VDSL2.
The 8970 is powered by the same Lantiq chipset (VRX268/288) as the ECI Telecom VDSL2 modems that BT Openreach supplies as CPE for its FTTC service in Britain.
And yet the 8970, although powered by an ADSL2+/VDSL2 chipset is marketed only as an ADSL2+ modem.
According to consumer reports, the Lantiq's performance is reportedly substandard to the Broadcoms in ADSL2+ mode.
But maybe it excels in VDSL2 mode? Others are saying good things about the Lantiq in VDSL2 mode on short to medium length loops, if not longer lines.