Is it possible to erase FLASH without CSM password?

Well, you've certainly got yourself into a situation!

Is the .hex file a complete image such that it contains the passwords?  If so, then my thinking is this will be the easiest file to deal with since it is ASCII, whereas the .out and .bin are binary files.  I assume this is one of the formats the compiler hex2000 tool produces, such as Intel format, or Motorola-S record, etc.  There is a description of these formats in the C2000 ASM Language Tools User's Guide, SPRU513G.  This will help you parse through the file.

Do you recall if in the source code, you had the passwords in their own named section?  That is how TI examples have it.  Hopefully you do, as that will make things a lot easier.  The passwords are at addresses 0x3F7FF8 - 0x3F7FFF.  If the passwords were in their own named section, that section would appear seperately in the .hex file along with its starting address of 0x3F7FF8, and have a length of 8 16-bit words (or 16 bytes, not sure if the .hex file shows byte or word lengths.  You'll need to look).  You can search the .hex file for 0x3F7FF8 (or various ordered forms for this, such as

00 3F 7F F8

3F 00 F8 7F

7F F8 00 3F

F8 7F 3F 00

You can probably figure out the byte endianess that the section addresses appear in the file.  You need to figure it out anyway for the data, as you need to get the passwords into the correct order assuming you are able to locate them.

This could be a pretty long and tedious process.

I have one other thought, but I cannot guarantee it will not lock up another board.  I recall that after flashing a .out file in CCS, the processor is NOT reset.  If the CSM is unlocked (which it will be during/after flash programming), it will not lock until you reset the device.  So, if you had another board, you could flash the .out file into the device using CCS.  Then, view the flash passwords in a memory location.  DO NOT RESET OR POWER CYCLE the device after flashing it until you see what the passwords are.  Otherwise, you're going to lockup that board too.  You would need to do this very carefully.  My suggestion would be to practice/verify the procedure first using a different .out file for which you know the passwords.  That way if it doesn't work (i.e., the CSM is locked after flash programming with CCS) you can recover the second board and know that you should not try it with the .out for which you don't know the passwords.

Good Luck and let us know how it goes.