Slovakia Flags Backdoor in Traffic Enforcement Devices, Tied to Russian Numbers
Slovakia’s National Security Authority (NBÚ) says it has found serious cyber weaknesses in traffic enforcement devices used in a pilot program, including a remotely activatable access path tied to a set of Russian phone numbers, a disabled or ineffective secure-boot process, and a camera video stream that could be accessed without a password. The findings are now prompting removal of the affected units and a criminal review into procurement.
What’s affected, where, and when
| Device series | Location / context | Status |
|---|---|---|
| NERO R-ONE | Slovakia pilot equipment reviewed by NBÚ | Removed from the pilot after analysis |
| Cordon / CORDON PRO.M | Slovak authorities’ security assessment | NBÚ issues an official warning for potential use elsewhere |
NBÚ classifies several models from the NERO R-ONE and Cordon lines as a “significant cyber threat.” For its investigation, the authority dismantled a sample of the NERO R-ONE that had been made available to it, reporting inconsistencies across origin details, hardware and software components, and the communications interfaces present in the unit.
Remote access via SMS linked to Russian numbers
The most critical issue described by NBÚ is an undocumented mobile communications mechanism. The device configuration contained twelve phone numbers using the Russian country code. According to NBÚ’s security notice, an SMS sent from one of those numbers could activate remote access; after the attacker also provided a password, the device could be controlled through shell and network access. Anyone with this access would, in effect, be able to largely operate the traffic enforcement unit.
NBÚ also reported additional connectivity components not properly reflected in documentation, including an extra 3G/4G module and an active Wi‑Fi capability. The authority says secure boot did not function as intended or was disabled, meaning the device did not reliably verify the origin of firmware it launched. In addition, the web interface contained multiple vulnerabilities.
On the camera side, NBÚ states that a preconfigured RTSP video stream was transmitted without a password to anyone who knew the device’s IP address.
While NBÚ says there is currently no evidence that the access methods were actually abused by Russian actors or any other group, the authority emphasizes that the existence of the pathways alone was sufficient to trigger an official warning.
Mixed markings: Cyprus label, Russian components
NBÚ reports that the NERO R-ONE listed a Cypriot firm, Sodasus, as the manufacturer. However, analysis of circuit boards, firmware, and the control unit led it to CORDON PRO.M, produced by the Russian company Simicon, based in Saint Petersburg.
In NBÚ’s account, “NERO R-ONE” primarily appeared on the Slovak-facing surface, while deeper layers of hardware and software pointed to the Russian platform.
Political fallout and actions inside Slovakia
The case has become politically sensitive. Slovakia’s Ministry of the Interior had previously denied using Russian devices, citing a closed network for government bodies. After NBÚ’s analysis, the ministry removed the two traffic enforcement units from the pilot program.
Slovakia’s top prosecutor, Maroš Žilinka, has instructed the prosecution service in Bratislava to carry out a criminal-law review related to the procurement.
No “279 devices” in service, ministry says
Multiple international reports claimed that 279 traffic enforcement cameras were already purchased or even installed. The Ministry of the Interior says that figure is incorrect.
It says the number came from an earlier tender for 213 stationary speed cameras, 48 analysis cameras, and 18 section-control systems—an acquisition that was paused. For the current pilot trial, only two devices were delivered and set up, according to TASR.
NBÚ’s warning is not limited to Slovak government infrastructure. The authority urges operators of critical services and other organizations to check whether they run devices from the NERO R-ONE or Cordon lines and to report any findings.
