Hanwha Vision revokes GitHub admin tokens after security flaw exposed in camera firmware

A security researcher has identified that firmware in Hanwha Vision’s XNP-9300RW security cameras contained hardcoded GitHub administrator tokens. The vulnerability stemmed from a build configuration error in the camera’s web interface, which inadvertently injected the entire continuous integration environment into the device’s codebase.

The researcher discovered the issue after extracting the firmware from the device. By bypassing encryption using a known passphrase structure and analysing the fwupgrader binary, the researcher reconstructed the root file system. Automated scanning of the extracted files revealed the GitHub token duplicated across approximately 30 files.

The exposed token granted administrator privileges to hundreds of repositories within the Hanwha organisation. The leak occurred because the camera’s user interface, built with Vite, included the entirety of the process.env variable at build time. This configuration error meant that the full CI environment, including sensitive credentials, was written into the firmware files.

Further analysis of the firmware environment revealed the presence of IP addresses assigned to the US Department of Defense. The researcher noted that while this could be a coincidence involving unused internal IP space, it raises questions about potential integration between the civilian camera division and defence-related infrastructure within the Hanwha Group.

Hanwha Vision, a subsidiary of the South Korean conglomerate Hanwha Group, responded promptly to the disclosure. The researcher reported the vulnerability to the company, which revoked the compromised tokens within 12 hours. The researcher also scraped and analysed approximately 500 firmware files across the Hanwha product line, finding the same token in three additional models.

While Hanwha Vision is primarily known for video surveillance, its parent group also manufactures military hardware, including the K9 Thunder self-propelled artillery and the SGR-A1 sentry gun robot. The researcher speculated that the presence of defence-related environment variables may stem from shared CI platforms within the Hanwha Group, linking the civilian and defence divisions.

The incident highlights the risks associated with shipping firmware that contains exposed credentials. Although the researcher was uncertain whether the token was actively served over the network to users or merely resided on the device’s disk, the scale of access provided by the admin token remains a significant security concern for the organisation.