It is working and totally easy!

All the benefits go to @solvisit he discovered it!

Heres a little tutorial to open the thermostat.

Preparations: Download firmware https://github.com/Se7enair/eurotronic-spirit-zigbee-firmware/blob/main/firmware-20191014-22190930-new.bin

Download FlashTool https://www.nxp.com/downloads/en/software-development-kits/JN-SW-4107.zip

Buy FTDI-Adapter https://www.amazon.de/AZDelivery-Adapter-FT232RL-Serial-gratis/dp/B01N9RZK6I/ref=sr_1_4?__mk_de_DE=%C3%85M%C3%85%C5%BD%C3%95%C3%91&crid=14LG084JIJ26C&keywords=ftdi+usb+adapter&qid=1639419985&sprefix=FTDI%2Caps%2C183&sr=8-4

Buy jumper cables https://www.amazon.de/AZDelivery-Jumper-Arduino-Raspberry-Breadboard/dp/B074P726ZR/ref=pd_bxgy_img_1/260-6644889-2185025?pd_rd_w=Hhy88&pf_rd_p=289750ef-2548-403a-9263-64d1c3b3297e&pf_rd_r=TM6NYNTCMGHDZSP5DWKT&pd_rd_r=cb200faf-da4a-4d48-8b46-7aa264575059&pd_rd_wg=XXXUu&pd_rd_i=B074P726ZR&psc=1

1. Pull out the batteries
2. Open the thermostat

• There is a ring at the backside, remove it gently

• There a four brackets to open. To open the first two, press firmly on the upper part on the battery side

• It should be opened a little bit

• Use a spatula or something similar to press down the case

• Move the spatula to the back/mounting ring

• Repeat on the other side

• Now the case should be open

3. Remove the zigbee-board
4. follow the instructions below
5. be happy

It is possible to replace the broken 20191014 firmware with a good 20191014 (or any other version), opening the TVR and programming the chip, it is not particularly difficult. Steps:

1. You need a working TVR from which extract the working firmware or getting the file from someone did it. I will post the firmware if Eurotronic will permit it.
2. You have to download the flash programmer for JN5179: https://www.nxp.com/downloads/en/software-development-kits/JN-SW-4107.zip
3. You need an FTDI adapter ( maybe it works with a serial to usb cable too, didn't tested)
4. Open the TVR
5. Take off the zigbee board
6. Connect it to the FTDI (not connected to USB) (see the image for wiring, there is an old hw version with the connectors on the other side, they are just translated not mirrorerd)
7. Connect the FTDI to USB while shortcircuiting the board (see image)
8. Open a Windows console with "cmd" and go to the flash programmer directory (default:"C:\NXP\ProductionFlashProgrammer") 8a) To extract the firmware launch the command (if i remember correctly, read the help for tips): JN51xxProgrammer.exe -s COM8 -S internal -F firmware.bin 8b) To program the firmware on the chip launch the command: JN51xxProgrammer.exe -s COM8 -S internal -f firmware.bin You have to try a few times to get connection with the chip, sometimes it doesn't work at first try. The chip is entered in programming mode if it does not to send packets, you can check it on the FTDI leds.

Thanks to @Se7enair