I'm thinking along the same path, regarding reading of power-meters. And i noticed this thread.
After browsing documentation regaring IEC 1107 protocol I'm wondering, arn't you trying to enter programming mode with baudrate 300, in your example?
Just as a test I sent an Acknowledgement with the programming command
06 30 30 31 0d 0a .001
If i understod the specs correctly the last digit after ack reads: 0- read, 1-program
what would happen if you try:
06 30 30 30 0d 0a .000
Will you still get the password request?