Oh, okay, I get it. The modem is running some kind of limited custom shell (aka. "command interpreter"). So it doesn't allow most commands, but apparently does have a built-in "ping" command. And the child who wrote the custom shell added backquote support to make it easier to script config stuff. And thereby also opened up a massive hole in the custom shell.

Surrounding an expression with backquotes tells the shell (command interpreter) to first run the command within the backquotes, and then provide the resulting output as a command line parameter to the original (ping in this case) command.

The telnetd command doesn't output anything useful to ping, but that's unimportant here. The idea instead is to just trick the shell into running a command it normally won't run, telnetd in this case.