I figured out how you can telnet into the camera. If yours is the same as mine there's probably a ftp server on it that has rw access in /etc/jffs2 which is where the shadow file is. If you need me to I can tell you how to replace it to put a custom password.
