Slovakia Issues Cybersecurity Warning on Vulnerable Speed Cameras
Slovakia's National Security Authority (NBÚ) has issued a warning regarding several road speed cameras, identifying them as a significant cyber threat. This alert highlights concerns not about the deletion of speeding tickets, but rather about the connected devices that gather vehicle data and communicate with various systems, potentially containing remote-access functions that are beyond the operator's control.
The Slovak authority conducted an examination of the NERO R-ONE camera system at the request of the Interior Ministry. In its warning, it specifically named three product lines: the NERO R-ONE devices from Cyprus-based SODASUS, the Cordon-series speed cameras manufactured by Russia's Simicon, and the Cordon-series products sold by Croatia's NEROline.
The alert states, "The National Security Authority warns of a significant cyber threat associated with the use of several types of road speed cameras." The analysis uncovered several risks and recommended that affected entities identify these products within their infrastructure.
The issues identified were not merely configuration errors. The NBÚ found discrepancies between the documented and actual communication settings, uncertainties regarding the origins of the hardware and software, software versions that did not match the declared specifications, and inadequate security protections.
One critical concern is the presence of pre-configured remote access and management mechanisms that are not fully controllable by the organization that owns the camera. Such blind spots in a system that may be integrated into public-sector networks or communicate with other operational services pose significant risks.
Road cameras are responsible for more than just capturing images and measuring speed; they also photograph vehicles, record timestamps, process license plate data, store evidence, and relay information to backend systems used by authorities. If compromised, attackers could manipulate data, alter or erase records, change how violations are measured or reported, or even disable the cameras. Furthermore, if the network lacks proper segmentation, attackers could leverage the camera as a gateway to access other systems.
The warning serves to inform essential service operators and other organizations about the serious cybersecurity risks posed by these road cameras. In adverse scenarios, attackers could exploit these vulnerabilities to disrupt networks, systems, or services.
In response to the findings, the Slovak Interior Ministry has reportedly halted the deployment of the equipment while investigations are ongoing. Additionally, the ministry has requested that the supplier remove the units and replace them with equipment that complies with Slovak and EU legal, technical, and security standards.
While the Russian connection adds a geopolitical layer to the situation, it is crucial to focus on the technical aspects of the warning. The NBÚ did not assert that every device is actively spying on users or contains a proven backdoor. Instead, the warning emphasizes identified security risks, limited operator control, uncertainties regarding hardware and software provenance, and remote management mechanisms that cannot be fully accounted for.
This situation underscores the importance of thorough security checks for connected public devices, which should not rely solely on brand names, invoice details, or vendor claims. Operators must have a clear understanding of the software and firmware running on their devices, how remote access is managed, and who holds control over it. Independent security testing, secure updates, and network segmentation are essential practices.
The lessons learned from Slovakia are applicable beyond its borders. As smart cameras, license plate readers, parking sensors, environmental monitors, traffic lights, and roadside communication systems become integral to public infrastructure, ensuring their security is as critical as protecting other vital systems.
