安全研究员在Hanwha Vision安全摄像头的固件中发现了一个GitHub管理员令牌被硬编码在30个文件中 [1]。该令牌具有对该公司GitHub组织中数百个仓库的管理权限 [1]。
泄露源于Hanwha在构建UI时的安全疏漏。研究员发现，在使用Vite构建过程中，整个process.env被写入了固件文件，导致敏感的环境变量（包括GITHUB_NPM_TOKEN）被暴露 [1]。据悉，约62%的已提取固件中发现了该令牌，在约500个固件中至少有3个包含同一令牌 [1]。
研究员已向Hanwha报告此问题，该公司在12小时内撤销了泄露的令牌 [1]。
A security researcher discovered a GitHub administrative token hardcoded into the firmware of Hanwha Vision security cameras, embedded across 30 files within the device software [1]. The token granted administrative access to hundreds of repositories within the company's GitHub organization [1].
The credential exposure resulted from a build process misconfiguration in which the entire CI environment variable set was written into the firmware during Hanwha's Vite-based UI construction, embedding sensitive data including the GitHub token in the format: var W = { GITHUB_NPM_TOKEN: "ghp_…", ... } [1]. The researcher also documented the firmware's encryption key and initialization vector [1].
Analysis of extracted firmware samples revealed the token present in approximately 62% of analyzed builds, with roughly three of every 500 firmware versions containing the same exposed credential [1]. Hanwha Vision responded by revoking the compromised token within 12 hours of being notified of the issue [1].