Some firmware versions have a hidden telnet service that allows manual flashing: