The techniques often involve exploiting known vulnerabilities (like CVE-2022-2003) to force the PLC to reveal the password in clear text.
Unified HMI default Username and Password??? - Siemens SiePortal
Advertisements for these tools typically claim support for a vast range of industrial brands. However, these claims are often unverified and may rely on exploiting old vulnerabilities. Brand Claimed Support (Example Series) CPM1A, CPM2, CQM1, CP1E, CP1L, CJ2M Siemens S7-200, S7-300, LOGO! Mitsubishi FX Series, A900, F930 Delta DVP-ES, EX, SS2, SX2 HMI Brands Weintek, Weinview, Pro-face, Samkoon, Delta DOP 🛡️ Safer Alternatives for Recovery