after enabling the IPCE_WEBSERVER option in the HU_NBT > 3000, a webserver is reachable in the network you connect to via the wifi at 172.16.222.1.
It appears to be lighttp, which means that the HU_NBT is unix/linux based.
There are two subdirs I could find: /core/ and /trace/. /core has nothing in it, probably used for core dumps after a crash, but /trace/ has detailed logs of every run.
These logs contain quite a lot of information, including all the destinations you programmed, voice commands, music listened to, and lots and lots of diagnostic info. The HU_NBT appears to be a dual core system, indicated by the cpu load info contained in the log.
I'm analyzing the log further and I hope to be able to gain shell access to the underlying OS of the NBT, this would give me the possibility to expand functionality through custom applications etc.