The problem
We expect enterprise security cameras to keep intruders out. We certainly do not expect them to serve as public distribution channels for the manufacturer’s own internal software keys.
Yet earlier this week, a security researcher named hhh revealed that is exactly what happened with Hanwha Vision, a major global manufacturer of commercial surveillance cameras. While analyzing the firmware updates for the company’s enterprise hardware (like the model XNP-9300RW), the researcher discovered an active GitHub Personal Access Token baked directly into the login page’s public JavaScript files.
This wasn’t just a low-level developer key. It was an administrative token that granted write access to hundreds of Hanwha’s internal software repositories. Anyone loading the camera’s login page had the token delivered straight to their browser, potentially exposing the manufacturer’s entire software supply chain.
How the firmware was unlocked
Getting to the files wasn’t supposed to be easy. Hanwha encrypts its firmware updates to prevent casual inspection, hiding the camera’s filesystem inside an obfuscated container.
But firmware encryption only works if the keys are kept secret. In this case, the decryption keys were compiled right into the camera’s own updater utility. Although the developers attempted to hide these credentials by scrambling the command fragments and AES-256-cbc keys using a simple XOR table, the utility had to reassemble them in memory to run the update.
By running the updater through a decompiler, the researcher easily extracted the hardcoded AES key and initialization vector. Because Hanwha reused these keys across the entire model line, once the researcher unlocked one firmware image, they could decrypt updates for hundreds of other models too.
The build tool that leaked the keys
Once the filesystem was decrypted, the researcher ran secret-scanning tools and found the admin token duplicated across roughly 30 frontend files in the camera’s web control portal.
The root cause was a build tool misconfiguration. The web UI was compiled using Vite, a popular modern bundler. During the build process, the system was configured to assign Node’s entire runtime environment (process.env) to a frontend global variable.
In a typical build pipeline, developers use environment variables to configure things like staging URLs or port numbers. However, when Vite was told to serialize the entire environment, it swept up everything on the build server. This included the runner’s workspace paths, Kubernetes ports, and the administrative GitHub npm token used to fetch private packages. Every time a camera was built, the builder’s entire set of secret credentials was hardcoded into the public JavaScript bundle.
The defense industry connection
The serialized environment dump did not stop at code repository keys. It also leaked active IP addresses assigned to the US Department of Defense, specifically on the 55.0.0.0/8 block managed by the Defense Information Systems Agency.
It is possible this is just a case of lazy network staging. Some engineers treat public, non-routable-to-them IP ranges as free sandbox space for internal testing. But Hanwha’s corporate history points to a stranger story.
Before rebranding as Hanwha Vision, the company was known as Samsung Techwin. The firm did not just make security cameras. They designed heavy military hardware, including self-propelled howitzers, armored resupply vehicles, and the SGR-A1 autonomous sentry robot built for border control.
Today, Hanwha’s consumer camera wing is separated from its defense sisters like Hanwha Aerospace. But if they still share a centralized CI/CD platform or network infrastructure, military testing environments could easily have left their fingerprints on commercial security camera code.
The takeaways
Hanwha Vision responded quickly to the disclosure, revoking the compromised GitHub token within 12 hours. But the leak highlights two critical gaps in how modern hardware gets built:
- Obfuscation is not security. Hiding AES keys inside a binary using basic XOR tables is a speed bump, not a lock. If you ship the key with the lock, someone will eventually use a decompiler to extract it.
- Build pipelines need strict boundaries. Vite defaults to only exposing variables prefixed with
VITE_for a reason. Bypassing that safety rail to dump your entire environment into client-side bundles is an easy way to upload your company keys to the public web. - IP cameras belong on isolated networks. Any device running complex, vendor-compiled firmware is an unknown risk. Segmenting security cameras on a dedicated VLAN with no internet access is the only way to ensure a frontend leak does not turn into a lateral network compromise.
