Hello Harald,
To find the problem my next step was to connect to the EC25 debug UART on pin 11/12. But the system needs a root password! The one you have on your wiki does not work anymore [2]. I think I have the same version "msm LNX.LE.5.0.1-57031-9x40 mdm9607-perf /dev/ttyHSL0" Do you have another password for this interface or where did you get this information from?
I suspect your easiest approach is to obtain the firmware update file and then extract the rootfs, specifically the /etc/passwd or /etc/shadow file, and then use a password cracker on that.
Thanks for the note. I got the latest firmware version and extracted the passwd Let's run the password cracker and see what comes out. I will contact you again when I have the password.
Thanks Flo