Interesting read! There's actually 3 parts to this:

Part 2: https://0x90.psaux.io/2020/03/19/Taking-Back-What-Is-Already...

And 3: https://0x90.psaux.io/2020/03/22/Taking-Back-What-Is-Already...

Summary from the end of Part 3:

"So we managed to change passwords for both ssh and telnet, gain access to Root user for the web interface, changed that password too. We changed ACS URL to ours and remove the IP restrictions. To put it simply, we cleaned up our router from our ISP. Good for our privacy."