Enabling telnet access is really easy thanks to the crappy software Asus made for this router. They actually share a web directory with executable CGI scripts - what we'll do is simply edit one of them to run the telnet server (or any other command we want).

Open (through FTP, SMB, NFS, doesn't matter) the files shares/MYSHARE1/web/Layout_English/index.cgi

As the very last line of the file, add:

/apps/bin/utelnetd -d

Save the file back to its original location, and go to the webpage you just changed:
http://192.168.1.1:8081/Layout/index.cgi

If instead of the regular page you see the contents of the file you just changed, it means the file was saved with the wrong permissions. Open an FTP connection to that directory, and use the following FTP command to change its permissions (how to do that depends on your FTP application):

CHMOD 0777 index.cgi

(which gives execute permission on the file)
and then try going to the above URL again. The page will show up as usual, but it also started the telnet server as a daemon. Just open a telnet connection to the router, and you'll be automagically logged in as root.

This was tested with firmware 1.0.4.6.