I'll see if I can ask them.
I'm trying to check out the BHRs right now for FiOS and it seems the CWMP port is not playing right with the tools. Hard to say if that means the protocol is not one that is expected or if it's the BHR not being vulnerable.