From UART to Root: Vendor Shell Escape on a Uniview IP Camera