When plugged in, the device sends some packets to the LAN : ARP, SNMP, and FTP.
We identified a TCP SYN to some specific address in the 192.168.70.0/24 range, so we just had to use ip addr to open a "fake" FTP server :
# nc -lp 21
220 EVIL SERVER READY
USER qstr2
331 Password required
PASS vxload
230 User logged in
TYPE I
200 Oker
CWD /gprs
250 dacore
PORT 192,168,70,103,4,12
halp :|