斯洛伐克发现交通摄像头内置俄罗斯后门程序

斯洛伐克国家安全局NBU发现该国采购的NERO R-ONE高速交通摄像头内置俄罗斯后门程序1。这些摄像头由俄罗斯圣彼得堡公司Semicon生产，是其CORDON PRO.M产品的改版1。后门机制允许通过硬编码的俄罗斯电话号码发送短信获得设备的shell和网络访问权限1。

这批摄像头是价值3000万欧元欧盟资助项目的采购组件，斯洛伐克内政部原计划在全国安装279台1。发现漏洞后，内政部已暂停部署并宣布将进行独立审计1。除了后门问题，这些设备还存在多个安全缺陷，包括SecureBoot被关闭、Web管理门户存在漏洞以及直播流缺乏密码保护1。类似设备也已在克罗地亚和东欧其他国家安装1。

Slovakia's National Security Bureau has uncovered a Russian backdoor mechanism embedded in traffic speed cameras purchased for deployment across the country 1. The devices, model NERO R-ONE, are actually modified versions of the CORDON PRO.M camera system produced by Russian company Semicon based in Saint Petersburg 1. The backdoor allows remote access through specially crafted text messages sent to a hardcoded Russian phone number, granting attackers shell and network access to the cameras 1.

The affected cameras were procured as part of a €30 million European Union-funded infrastructure project, with the Slovak Interior Ministry planning to install 279 units nationwide 1. Following the security discovery, the ministry has suspended deployment and announced plans to conduct an independent audit 1. Beyond the backdoor vulnerability, investigators identified additional security flaws including disabled SecureBoot, multiple vulnerabilities in the web administration portal, and unencrypted live video streams 1. Similar devices have also been installed in Croatia and other Eastern European nations 1.