On a Broadcom Based router (with the CFE boot loader), once you have access to a serial console, you will be able to use the following commands: Different CFE implementations omit some of the commands, however these are the ons that I use the most.
To save the entire contents of Flash
To save just the CFE
Note: The address provided here is what I have been using on a WL500gPv2. the real CFE address starts at 1c000000: bc000000 is some cached copy, but it is OK, It appears that the TFTP client in the CFE can't read the real address for some reason. Your mileage may vary.