A security researcher discovered a significant vulnerability in Hanwha Vision security cameras, where a GitHub admin token was inadvertently shipped within the camera's login page firmware. The researcher initially obtained firmware blobs from the Hanwha website and, after decrypting them, used trufflehog to scan for sensitive information. This scan revealed a GitHub token present in approximately 30 files. The token possessed admin privileges to hundreds of repositories within the organization's GitHub account.

The vulnerability appears to stem from the camera's UI build process, which uses vite. During the build, the entire `process.env` was apparently assigned to a variable, embedding the CI job's environment, including the sensitive GitHub token, into the firmware files. The researcher also noted unusual IP addresses associated with the US Department of Defense within the firmware's environment variables, speculating about potential ties or shared infrastructure.

After downloading and analyzing around 500 firmware files, the researcher confirmed that the same GitHub token was present in 62% of the extractable firmware. A security disclosure was sent to Hanwha, who responded promptly within 12 hours, revoking the exposed token.