Hanwha Vision安全摄像头固件泄露GitHub管理员令牌

安全研究员在Hanwha Vision安全摄像头的固件中发现了一个GitHub管理员令牌被硬编码在30个文件中 1。该令牌具有对该公司GitHub组织中数百个仓库的管理权限 1。

泄露源于Hanwha在构建UI时的安全疏漏。研究员发现，在使用Vite构建过程中，整个process.env被写入了固件文件，导致敏感的环境变量（包括GITHUB_NPM_TOKEN）被暴露 1。据悉，约62%的已提取固件中发现了该令牌，在约500个固件中至少有3个包含同一令牌 1。

研究员已向Hanwha报告此问题，该公司在12小时内撤销了泄露的令牌 1。

A security researcher discovered a GitHub administrative token hardcoded into the firmware of Hanwha Vision security cameras, embedded across 30 files within the device software 1. The token granted administrative access to hundreds of repositories within the company's GitHub organization 1.

The credential exposure resulted from a build process misconfiguration in which the entire CI environment variable set was written into the firmware during Hanwha's Vite-based UI construction, embedding sensitive data including the GitHub token in the format: var W = { GITHUB_NPM_TOKEN: "ghp_…", ... } 1. The researcher also documented the firmware's encryption key and initialization vector 1.

Analysis of extracted firmware samples revealed the token present in approximately 62% of analyzed builds, with roughly three of every 500 firmware versions containing the same exposed credential 1. Hanwha Vision responded by revoking the compromised token within 12 hours of being notified of the issue 1.