The device is using busybox, and does have telnet and wget, but the cmd/unix/reverse doesn't appear to work for me at all. Even if I issue the commands myself and setup my own handler.

However, I just read this interesting article, which could be a possibility: https://community.rapid7.com/community/metasploit/blog/2013/04/05/compromising-embedded-linux-routers-with-metasploit