S7-300 CPU Locked
While I am not familiar with this brand of PLC, the password and other programming instructions are probably stored in an EAROM - Electrically Alterable Read Only Memory chip. So if the chip is in a socket, you could remove the chip and put it in a reading device and dump the contents out to a reader, then you should be able to recover the password. Obviously this is what the manufacturer could do for you if you could get them to do it.
It sounds like a hacker with the right tools could decode it for you. Unfortunatley I don't have the tools available but in theory, that's the way to go.