Hanwha security camera firmware exposed GitHub admin token
Original: My security camera shipped a GitHub admin token in its login page
Why This Matters
CI environment leaks in embedded firmware represent a critical, underappreciated supply chain security risk for enterprise IoT devices.
A researcher discovered that Hanwha Vision security camera firmware contained a GitHub admin token with administrative access to hundreds of repositories, embedded across approximately 30 files due to a Vite build configuration error that leaked the entire CI environment into shipped code.
Security researcher and blogger discovered that Hanwha Vision camera firmware contained a hardcoded GitHub token with admin-level access to hundreds of repositories in the company's GitHub organization. The token appeared in roughly 30 files within the firmware's rootfs.
The root cause was a Vite build misconfiguration: a variable was set to the entirety of `process.env` at build time, causing the full CI environment — including a `GITHUB_NPM_TOKEN` — to be compiled into static JavaScript files served as part of the camera's web admin UI. This means any user accessing the camera's admin interface would likely have received the token over the network.
To reach the rootfs, the researcher first used publicly documented passphrase conventions (HTW + model number) to decrypt an outer firmware archive, then used Claude Code to reverse-engineer a `fwupgrader` binary. The binary used XOR-obfuscated AES key fragments reassembled at runtime, which the researcher fully reconstructed and published. The researcher used TruffleHog to detect the token after gaining filesystem access. The researcher disclosed the issue; no exploitation timeline was provided.