The stock firmware has a recovery mode triggered by holding down the reset button on power-up or hitting escape at the serial console. The recovery interface is accessible via HTTP at 192.168.1.10. The OpenWrt factory image is compatible.
The version of U-Boot on the device is seriously crippled. It does not (apparently) have a command-line prompt. Thus, firmware flashing is done only via the existing firmware or the aforementioned recovery mode.