Slovakia halts deployment of traffic cameras after Russian backdoor and security flaws found

Slovakia’s national security service (NBU) identified a backdoor in NERO R-ONE traffic cameras, which are rebranded Russian CORDON PRO.M models. The backdoor allows remote access via SMS from a predefined list of Russian phone numbers, bypassing authentication. This mechanism is hardcoded, meaning it cannot be patched or disabled without replacing the firmware entirely. The cameras were part of a €30 million EU-funded project, raising questions about procurement oversight and supply chain security for critical infrastructure.

Beyond the backdoor, the cameras exhibit multiple security flaws. SecureBoot, a feature designed to ensure only trusted firmware runs, is disabled, leaving the devices vulnerable to firmware tampering. The web management portal contains unpatched vulnerabilities, and live video streams are accessible without authentication to anyone who knows the camera’s IP address. These issues compound the risk, as even a closed network deployment does not mitigate the potential for lateral movement or data leakage.

The Interior Ministry initially dismissed concerns, claiming the cameras posed no risk on a closed network. However, the NBU’s technical report forced a pause in deployment, with an independent audit now planned. The incident underscores the danger of assuming isolation equals security, especially when hardware originates from geopolitically adversarial sources. Similar devices may already be in use in Croatia and other Eastern European countries, suggesting a broader risk.

For engineers, this event is a case study in the limitations of network segmentation. The backdoor’s SMS-based activation could bypass perimeter defenses, and the lack of SecureBoot means firmware integrity cannot be guaranteed. The unprotected live streams further demonstrate how poorly secured devices can undermine even well-designed systems. The pause in deployment provides an opportunity to reassess procurement policies, particularly for hardware with opaque supply chains or ties to high-risk vendors.