Cyprus-based SODASUS investigates radars in Slovakia. Serious vulnerabilities identified

Cyprus-based SODASUS is listed as the manufacturer of the NERO R-ONE traffic control system, which came under scrutiny by Slovak security services. Analysis of the device revealed remote access mechanisms, software incompatibilities, and stored Russian telephone numbers.

Two NERO R-ONE cameras have already been tested in Slovakia, including one in Bratislava. After the analysis results were released, the devices were removed, and other Slovak institutions became interested in the case.

SODASUS from Cyprus as the manufacturer of the device

The case concerns the NERO R-ONE system intended for automatic road traffic control.

In the official Slovak type approval certificate the manufacturer of the device is listed SODASUS LTD, Cyprus.

Certificate No. 044/1/162/26 was issued on 30 June 2026 and remains valid until 30 June 2036.

The application for certification was submitted by the Slovak company it-s.

It is important to distinguish between the manufacturer listed in the documents and the direct contractor of the Slovak Ministry of the Interior. The Slovak company Soitron participated in the project.

What is known about the company in Cyprus?

CYPRNews checked publicly available registration data for SODASUS LTD.

The company was registered in Cyprus on August 24, 2021 and is still listed as active.

Her registration number is HE 424916and the registered address is in Strovolos, Nicosia.

Publicly available data lists FIDESTA MANAGEMENT LTD as the company's director, while Evripidis Pavlou is the company's secretary.

SODASUS currently presents itself as a technology company offering solutions for public administration, critical infrastructure, and road traffic control systems, among others.

In the official Slovak documentation, the Cypriot company was indicated as the manufacturer of NERO R-ONE.

Slovak services investigated the system

The National Security Agency of Slovakia, NBÚ, conducted a technical analysis of the NERO R-ONE at the request of the Ministry of Interior of the Slovak Republic.

On August 14, the office published a warning about a serious cybersecurity threat related to the analyzed measurement systems.

Experts pointed out, among other things, doubts regarding the actual origin of the hardware and software.

Differences were also found between the technical documentation and the actual configuration of communication interfaces.

The analysis also revealed the presence of mechanisms allowing remote access and management of the device.

The software version in the tested system did not match the one indicated in the technical documentation.

12 Russian numbers and SMS support

Further details of the analysis were published by the Slovak television Markíza.

According to her findings, the device contained 12 saved phone numbers from Russia.

They were to be connected, among others, with St. Petersburg and the Kemerovo Oblast.

An additional 3G/4G communication module was also found in the system, which was not described in the documentation.

The device had the ability to receive commands sent via SMS messages.

The analysis also showed active Wi-Fi and the ability to transmit images via RTSP without password protection for a person with access to the device's network.

The cameras have already been tested on the roads.

The case did not concern only the device located in the laboratory.

Two NERO R-ONE systems were tested in Slovakia. One device was used in Bratislava, the other in Trnava.

Systems of this type allow monitoring of several lanes at the same time and recording vehicles and people in them.

After the results of the analysis were disclosed, Interior Minister Matúš Šutaj Eštok decided to remove the tested devices.

The Ministry maintains that it was misled about the origin of the equipment supplied.

The purchase of the equipment was related to a project financed by the EU Recovery Plan.

The matter was taken up by other institutions

Doubts about the cameras also caught the attention of the Slovak Personal Data Protection Office.

The office has initiated proceedings related to the systems. The matter is particularly important due to the possibility of registering not only vehicles but also drivers and passengers.

The Slovak Prosecutor General Maroš Žilinka also ordered an investigation into the circumstances surrounding the purchase of the devices.

The technological trail leads to Russia

Even before the official NBÚ warning was published, Slovak media pointed out the similarities of NERO R-ONE to the systems of the Russian company Simicon from St. Petersburg.

Further analyses revealed technological links between the software and solutions used in Russian traffic control systems.

The Swiss daily Neue Zürcher Zeitung also covered the matter, drawing attention to the Russian origin of some of the technology behind the devices formally certified as products of a Cypriot company.

However, the full structure of commercial relations between SODASUS, the Russian Simicon and the companies participating in the project in Slovakia has not yet been publicly presented.

The case sparked a political dispute

The services' findings also triggered political reactions.

The opposition Progressive Slovakia party began demanding the resignation of Interior Minister Matúš Šutaj Eštok.

Criticism also emerged from within the government. Minister of Tourism and Sports Rudolf Huliak publicly questioned the manner in which the entire operation was conducted and also spoke about the responsibility of the Minister of Internal Affairs.

Prime Minister Robert Fico, however, defends the minister and downplays the possibility that the two tested devices could pose a threat to state security.

Where does the number 279 cameras come from?

The number often appears in the case information 279 traffic control systems.

However, it does not mean that Slovakia purchased 279 NERO R-ONE devices from SODASUS.

The number relates to a broader program of the Slovak Ministry of Interior related to the expansion of the automatic road traffic control system.

In the case of NERO R-ONE, there were two devices used for testing.

SODASUS is listed as the manufacturer in the certification documentation. The certification application was submitted by it-s, while Soitron was the contractual partner of the Slovak Ministry of the Interior.

Data transfer to Russia not confirmed

An important caveat is needed in this whole matter.

Yet no evidence was provided that data from the tested devices was actually transmitted to Russia.

It has also not been confirmed that the detected remote access capabilities were actually used for spying or unauthorized information acquisition.

Official findings primarily concern the technical capabilities of the device, inconsistencies with documentation, and cybersecurity threats.

The case raises questions about the origin of the technology used in the state infrastructure and the certification process of the system, whose manufacturer in official documents was indicated as a company registered in Cyprus.

Sources: National Security Agency of Slovakia (NBÚ), Slovak metrological and certification bodies, Cypriot company registration data, SODASUS, Aktuality.sk, TV Markíza, Neue Zürcher Zeitung, Politis, TVN24/PAP, Interia