Using the "debug" user and select system/nvram is very reliable - if the default password "synnet" has not been changed. The other way is brute force, but works 100 %:
Power off the lanplex, open the chassis and remove the lithium battery, shorten the battery connectors with a scredriver, wait 2 sec and put the battery back in the socket. Thats it. After this procedure, all config data including the passwords are reset to default. If you get stuck in the boot process after the message, that all nvram-data has been rewritten by flash default, just press Escape.
Finished !