I haven't spent a lot of time in the stock firmware for this generation of device but it should be possible.
You should be able to gain shell access using acp_commander and the "-o" option:
https://github.com/1000001101000/acp-commanderThat will blank out the root password and attempt to start telnet on the device. If that works you can log in via telnet and make any changes you want including reconfiguring/starting the ssh daemon. If telnet fails to start the root password will still have been cleared so you'd be able to attach a monitor and keyboard and do the same thing, or use the "-s" psuedo-shell mode of acp_commander for that matter.
Another option is to replace the firmware with a Debian Linux install which includes a more modern SSH daemon (though that's basically all it starts with):
https://github.com/1000001101000/Debian_on_Intel_Terastations
