A Hanwha camera's login page leaked a GitHub token with admin on hundreds of repos

Hanwha Vision shipped a live GitHub admin token inside its camera’s login page. A security researcher found it while pulling apart the firmware, and it turned out to grant admin access across hundreds of the company’s private repositories.

Credentials baked into shipping products are an old story in IoT, but this one is worse than most. The token wasn’t buried in server-side firmware a defender might never see. It rode down to the browser of every admin who opened the camera’s web interface, in plain client-side JavaScript. Anyone holding it could have pushed code, altered releases, or planted backdoors across Hanwha’s development, the supply-chain foothold behind incidents like the Tata Electronics breach that spilled Apple’s iPhone 18 Pro files.

What we know

The researcher documented the find in a writeup published July 24, walking through the firmware, the leaked token, and how Hanwha responded. As the researcher put it in the writeup, “anyone accessing the admin ui of these cameras likely has had this github token sent to them over the wire.” That’s the whole problem in one line. A secret that should have stayed on a build server was handed to every operator who ever opened the camera’s control panel. Here’s what the post establishes:

• The token was live and powerful. In the researcher’s account, “it had admin privileges to hundreds of repositories in their github organization,” enough to modify code across Hanwha’s development.
• It shipped in client-side code. Hanwha builds the camera UI with Vite, and a build step wrote the entire process.env, token included, into the bundle the browser loads.
• It was widespread in the firmware. The token appeared duplicated across roughly 30 files in the UI bundle of the Wisenet XNP-9300RW, one model the researcher examined.
• Hanwha revoked it fast. After the report, the company “responded within 12 hours notifying me that the token had been revoked,” the researcher wrote.

This is a textbook build-time env inlining mistake: the bundler copied secrets straight from the build machine into files the browser downloads. The token most likely came from a CI/CD variable that was never meant to leave the pipeline, a stolen-credential problem attackers usually have to phish for, like the crews behind the Scattered Spider intrusions.

What we don’t know

Hanwha’s quick revocation closes the immediate hole, but plenty stays open. The writeup and the Hacker News discussion leave these unanswered:

• Whether anyone grabbed it first. There’s no public evidence the token was abused before revocation, and no way to rule it out either.
• The full device scope. The researcher scraped around 500 Hanwha firmware images and pulled most of them apart; only three carried the token. Which shipping models and versions exposed it isn’t mapped.
• What the token touched. “Hundreds of repositories” is the researcher’s count. Hanwha hasn’t said what those repos held, or whether any release artifacts were altered.

The finding rests on the researcher’s own writeup, the only primary account, and the author didn’t attach a name. Hanwha Vision, formerly Samsung Techwin and the maker of the Wisenet line, hasn’t issued a public statement beyond the private revocation notice the researcher described.

What this means for you

If you run Hanwha or Wisenet cameras, this specific token is dead, so there’s nothing to panic-patch. The lesson sits one level up. Treat every network camera as a device that can leak, and keep it off routes it doesn’t need: a locked-down VLAN with no outbound internet is standard advice, and it holds here. Firmware you can’t inspect carries risks of its own, as the Secure Boot key expirations recently showed. For anyone shipping firmware or web UIs, the takeaway is blunter. Secrets don’t belong in a frontend build, ever. One misconfigured Vite step turned a private CI variable into a credential broadcast to every admin who logged in. Scan bundles for secrets before release, scope tokens to the narrowest access they need, and rotate anything that has touched a build machine. Hanwha’s 12-hour turnaround was the one thing that went right.