A security researcher examining firmware for a Hanwha Wisenet XNP-9300RW surveillance camera reported finding a GitHub token embedded across multiple files, with administrative privileges over hundreds of repositories in the manufacturer’s organization. According to the researcher’s account, Hanwha revoked the credential within 12 hours of receiving a concise disclosure.
The investigation began with firmware files made available for camera models on Hanwha’s website. The researcher used the known model-based passphrase for an outer archive, then encountered another encrypted firmware package. Analysis of an included upgrade program indicated that the software reconstructed an AES key from values obscured with a static XOR table. The initialization vector was stored in plain text, and the upgrader invoked the OpenSSL command-line tool using command fragments hidden in a similar way.
With the root filesystem extracted, the researcher scanned it for secrets. The same GitHub token appeared in roughly 30 files. The account attributes the repetition to a web interface built with Vite in which a variable was apparently populated with the full build process environment. That configuration caused continuous-integration environment data to be written into generated files.
The researcher verified that the credential could administer hundreds of repositories. The post does not establish that the files were necessarily delivered through the camera’s web interface to every administrator; it distinguishes that possibility from the alternative that they remained only on disk. Either location would still represent an embedded secret in distributed firmware and create a route for anyone able to obtain and unpack the image.
To assess the scope, the researcher downloaded about 500 firmware packages from a catalog of more than 600 camera models. The same extraction method worked on 62% of them. Three extracted images contained GitHub credentials, all copies of the same token, rather than a larger collection of unrelated keys.
The firmware also contained internal addresses drawn from space assigned to the US Department of Defense. A correction added on July 27 records Hanwha’s explanation that this was not evidence of a government link: the company said it had unknowingly inherited the addressing scheme from predecessor Samsung Techwin and planned changes to its network structure.
The episode illustrates how build environments can leak far beyond their intended boundary when an application bundles more variables than it needs. Obfuscating firmware did not protect a reusable credential once both the decryption process and key material shipped with the product. The rapid revocation limited the known exposure after disclosure, but the account does not state how long the token had been present or whether anyone else used it.
