Slovakia Finds Russian Backdoor in Traffic Speed Cameras

Slovakia's National Security Authority (NBU) has issued a security alert against the NERO R-ONE high-speed traffic cameras, saying the devices contain hidden remote-access functionality. The warning followed an investigation opened after opposition politicians accused the government of buying the cameras from Russia.

A backdoor triggered by SMS

According to the NBU, the cameras contain a backdoor mechanism that grants shell and network access to the device through an SMS message received from a list of hardcoded Russian phone numbers. The service also acted on multiple reports in Slovak media that linked the purchase to a Cyprus shell company with fake certifications.

The authority says the cameras are a rebranded version of a Russian traffic camera model called CORDON PRO.M, produced by the St. Petersburg firm Semicon.

A €30 million EU-funded project

The devices were bought as part of a €30 million EU-funded project to rebuild the country's national traffic monitoring system. The Interior Ministry has bought and was preparing to install 279 cameras on selected roads across Slovakia.

The ministry initially denied that the cameras were of Russian origin and said there was no danger of data theft, because the devices were going to run on a closed Ministry network.

More flaws in the same devices

An NBU technical report lists further problems beyond the backdoor: the cameras ship with the SecureBoot feature switched off, so the origin of the firmware is never enforced; the web management portal contains multiple vulnerabilities; and the devices expose live video streams to anyone without a password who knows their broadcasting IP address.

Interior Ministry officials paused the deployment after the NBU report and said they would order an additional assessment from an independent auditor to confirm the findings. According to the bulletin, similar devices are allegedly installed in Croatia and possibly in other Eastern European countries.