Slovakia's National Security Authority (NBU) has published a technical alert concerning the NERO R-ONE high-speed traffic camera system, revealing a backdoor mechanism that grants shell and network access to any device in the fleet via a specially crafted SMS message sent from a set of hardcoded Russian phone numbers. The full bulletin is covered by Catalin Cimpanu at Risky Business, and the technical report from the NBU provides enough detail to treat this as a serious case study in supply chain compromise of physical critical infrastructure.
The cameras are a rebranded version of the CORDON PRO.M, manufactured by Semicon, a St. Petersburg-based firm. They were procured as part of a 30 million euro EU-funded project to modernise Slovakia's national traffic monitoring system, with 279 units slated for deployment across selected roads. The Interior Ministry initially denied the Russian provenance of the hardware and argued that a closed-loop network deployment would prevent data exfiltration. That argument, as the NBU findings make clear, was technically inadequate.
The Backdoor Mechanism and Its Design Implications
The SMS-triggered shell access mechanism is architecturally significant. It implies that the device firmware includes a GSM modem interface that is actively monitored by a privileged process, and that this process is capable of interpreting specific message content as authenticated commands. The use of hardcoded originating phone numbers as the authentication mechanism is a weak pre-shared credential scheme, not meaningfully different from a static password. Any adversary who obtained those numbers, whether through signals intelligence, SIM cloning, or simple enumeration, would have equivalent access.
This is not an obscure or novel attack surface. SMS-based command-and-control has been documented in embedded and IoT firmware for well over a decade, including in legitimate remote management applications for industrial equipment. What is notable here is the deliberate obfuscation through rebranding. The device was sold under a different name, with allegedly falsified certifications routed through a Cyprus shell company, specifically to obscure its origin. That is not a firmware bug; it is a procurement-layer deception that security assessments conducted only on the final product would likely miss unless they included firmware extraction and binary analysis.
The Full Vulnerability Surface
The backdoor is the headline finding, but the NBU report identifies a cluster of compounding weaknesses that together represent a poorly secured device at every layer of its stack:
- SecureBoot disabled: The secure boot feature is turned off, meaning the device will execute unsigned firmware. An attacker with physical access, or who can push a firmware update through the management interface, can install arbitrary code with no cryptographic verification.
- Web management portal vulnerabilities: Multiple unspecified vulnerabilities in the administrative web interface. Without the full CVE breakdown, the precise severity is unclear, but combined with the absent SecureBoot, exploitation could lead to persistent firmware modification.
- Unauthenticated live stream exposure: The cameras broadcast live video accessible to anyone who knows the device's IP address, with no authentication required. On a nominally closed network this might seem acceptable, but network segmentation is rarely as airtight in practice as it is on paper, and IP ranges for government infrastructure are often discoverable.
The combination of these three issues alongside the backdoor means the device fails at firmware integrity, administrative access control, and data confidentiality simultaneously. This is not a device that was reasonably secure but happened to have one overlooked flaw. The security posture is comprehensively deficient.
Supply Chain Security and the Limits of Closed-Network Arguments
The Interior Ministry's initial defence, that the cameras would be on a closed Ministry network, reflects a persistent and dangerous misconception about network isolation as a security boundary. Air-gapped and closed-loop networks have been repeatedly shown to be insufficient mitigations for compromised hardware. The NERO R-ONE's SMS backdoor is a textbook illustration of why: the GSM modem provides an out-of-band communication channel that is entirely independent of the IP network the device is connected to. A closed Ethernet loop does nothing to prevent an SMS-triggered shell session.
This is structurally analogous to the Stuxnet case, where air-gap assumptions were defeated by a combination of hardware-level persistence and out-of-band propagation vectors. The lesson has been available for fifteen years. The fact that it had to be relearned here, at the procurement level of a government infrastructure project, points to a failure of security requirements specification rather than a failure of detection.
Supply chain security for physical infrastructure is considerably harder than for software. Software supply chains benefit from reproducible builds, dependency auditing, and increasingly from tools like software bills of materials (SBOMs). Hardware supply chains have no equivalent standardised transparency mechanism. Firmware binaries are often proprietary, extraction requires physical access or exploit, and rebranding can obscure provenance from all but the most thorough teardown analysis. The NBU's investigation was triggered not by technical screening at procurement but by political scrutiny and investigative journalism. That is not a scalable security process.
Geographic Spread and the Broader IoT Threat Model
Reports suggest similar devices may be deployed in Croatia and possibly other Eastern European countries. If confirmed, this represents a distributed fleet of compromised devices embedded in national road infrastructure across multiple EU member states, each individually addressable via SMS from Russian phone numbers. The threat model for such a fleet is not limited to data exfiltration. Traffic cameras with network access and writable firmware could plausibly be used for:
- Surveillance and movement tracking of specific vehicle registration plates across national road networks.
- Denial-of-service against traffic management systems if the cameras feed into centralised control infrastructure.
- Lateral movement into Ministry networks if the closed-loop assumption ever breaks down, whether by misconfiguration, maintenance activity, or future network integration.
- Persistent access that survives standard incident response, given the disabled SecureBoot and SMS out-of-band channel.
This sits within a well-documented pattern of Russian intelligence services embedding persistent access in infrastructure hardware well in advance of any specific operational requirement. The VPNFilter campaign, which targeted routers and network-attached storage devices across Ukraine and NATO member states, followed the same logic: pre-position access, wait for strategic utility. Traffic cameras in a country bordering Ukraine, bought using EU infrastructure funds, represent a target of obvious intelligence value.
What Adequate Procurement Security Would Look Like
The NBU findings suggest that a basic hardware security assessment, conducted before deployment, would have caught these issues. Firmware extraction, static binary analysis for hardcoded credentials and phone numbers, SecureBoot configuration verification, and web interface fuzzing are all standard techniques. None of them require nation-state resources. The absence of such an assessment in a 30 million euro procurement is the most operationally significant failure in this incident.
For critical infrastructure procurement, a reasonable minimum bar would include: mandatory firmware source disclosure or escrow for government contracts, independent third-party binary analysis before deployment approval, explicit contractual prohibition on out-of-band management interfaces not disclosed in technical specifications, and ongoing network traffic monitoring for anomalous behaviour post-deployment.
The Interior Ministry has paused deployment and commissioned an independent audit. That is the correct response, but it comes after the procurement decision was already made and the devices were in-country. The audit should now inform whether the devices can be remediated, whether equivalent units are deployed elsewhere in the region, and whether the procurement process that allowed this to happen meets any reasonable security standard for EU-funded infrastructure projects.
The broader implication is that hardware supply chain security for public infrastructure needs to be treated as a first-class security requirement, not an afterthought triggered by political opposition. The NBU's technical work here is exemplary. The procurement process that made it necessary was not.