NBU Technical Report Details SMS Backdoor in 279 NERO R-ONE Cameras

NBU issued the alert after opposition accusations and media links to a Cyprus shell company. The €30 million EU-funded project purchased 279 units for national traffic monitoring. Interior Ministry initially denied Russian origin and asserted closed-network isolation before pausing deployment for an independent audit. The technical report lists disabled SecureBoot, multiple web portal vulnerabilities, and unauthenticated live video streams accessible by IP.

The report documents the backdoor mechanism alongside absent firmware enforcement and exposed services. Similar CORDON-series devices appear in Croatia and other Eastern European deployments. This configuration matches documented patterns in Russian-manufactured IoT where remote access persists regardless of claimed network segmentation, enabling potential command execution without physical presence.

Supply-chain exposure extends beyond Slovakia to any operator relying on rebranded Semicon hardware for critical infrastructure. Hardcoded numbers and disabled security controls indicate intentional design rather than oversight. Comparable incidents in Ukrainian and Baltic traffic systems show that once deployed, removal requires full hardware replacement and forensic validation of data flows.

Ministry officials will commission an external auditor assessment. Results are expected to trigger either removal or network-level blocking of the affected units. EU-wide procurement reviews of Russian-origin IoT in public safety systems are likely to follow.