Slovakia finds Russian backdoor in traffic speed cameras

Text a speed camera from a Russian phone number, and you get full remote control.

Slovakia's national security agency (NBU) warned that 279 new traffic cameras contain a built-in Russian backdoor. The devices, sold as NERO R-ONE, are rebranded CORDON PRO.M units made by St. Petersburg firm Semicon. According to the NBU technical report, sending an SMS from hardcoded Russian numbers grants full shell and network access. To make matters worse, SecureBoot was disabled, management web portals were vulnerable, and live camera streams were visible without a password to anyone who knew the IP address.

Why it matters: Buying rebranded Russian hardware for critical national infrastructure is a major supply chain failure, especially on a €30 million EU-funded project. Slovakia's Interior Ministry initially claimed the closed-loop network was safe, but paused deployment following the security report. Similar devices are reportedly installed in Croatia and across Eastern Europe.

Know this: Local media previously linked the camera purchase to a Cyprus shell company using fake certifications. The ministry is ordering an independent audit to confirm the findings before moving forward.

Next time you get a speeding ticket in Eastern Europe, check who is watching the feed.