Adversary Intelligence — 2026-08-21

Slovakia Discovers Russian Backdoor in 279 Traffic Speed Cameras Enabling Remote Code Execution via SMS from Russian Numbers

BLUFFico's dismissal of the backdoor as a non-threat makes contract termination unlikely within six months, leaving 279 SMS-exploitable cameras as persistent collection platforms on Slovak infrastructure.

Slovakia's National Security Authority (NBU) identified an undocumented module tied to 12 Russian phone numbers, from the St. Petersburg and Kemerovo regions, embedded in NERO R-ONE speed cameras, warning that an SMS from those numbers combined with a password could grant an operator full remote control and code execution 12. NBU's technical report found the cameras are a rebranded version of the Russian Cordon.Pro.M system built by St. Petersburg-based Semicon, with SecureBoot disabled and live video feeds exposed to anyone who knows a camera's broadcasting IP 23. The 279 units were procured for roughly €30 million under an EU-funded traffic monitoring project through a no-bid deal with Sodasus, a Cyprus-registered company using fake certifications, according to Slovak media reporting cited by Cybernews and dev.ua 13. The Interior Ministry initially denied the cameras were Russian-made and disputed any data-theft risk, then paused deployment and said it would commission an independent audit, while Prime Minister Robert Fico stated he does not view the cameras as a security threat 12. The findings, disclosed by the opposition Progressive Slovakia party on August 17 after it obtained the NBU assessment via a freedom-of-information request, were based on testing of only two camera units, and NBU's source-code review separately flagged 260 locations with unsafe command-execution calls capable of granting an attacker full administrator-rights code execution, a remote-control finding camera supplier Soitron disputes as false 123.

Analysis
The Interior Ministry is unlikely to terminate, void, or indefinitely suspend the Sodasus contract within six months: Fico's public dismissal of the backdoor as a non-threat, paired with a pause-and-audit response rather than cancellation, signals the government intends to manage the finding politically while protecting a sunk €30 million EU-funded procurement, leaving the 279 cameras with SMS-triggered remote access and unauthenticated live-feed exposure in the interim. Confidence in this judgment is low, resting on a single leaked technical assessment with no visibility into the pending audit's scope or timeline. The ministry's initial denial may reflect damage control over an embarrassing no-bid deal rather than a genuine technical clearance. The outcome determines whether Bratislava leaves a functioning Russian backdoor on national traffic infrastructure or reopens procurement, shaping EU partners' scrutiny of Slovak critical-infrastructure vendor vetting.

4 sources