Topic

#Supply Chain

3 articles

high1 source

Slovak Cyber Authority Uncovers Russian Backdoors and Undocumented Hardware in Speed Cameras

Slovakia's national cybersecurity agency, the NBÚ, published an advisory detailing significant security anomalies in roadside speed enforcement cameras. The investigation focused on the NERO R-ONE family from Cyprus-based SODASUS alongside Cordon-series hardware manufactured by Russia's Simicon and Croatia's NEROline. An audit requested by the Slovak Ministry of the Interior revealed marked discrepancies between the hardware documented on paper and the physical components inside the devices. Security analysts uncovered undisclosed remote access capabilities outside operator control, substandard baseline security, and measurement software that did not match declared specifications. Industry reporting from security consultant Samuel Kohen highlighted that the firmware contained 12 hardcoded Russian telephone numbers and hidden cellular communications hardware. Furthermore, raw video streams were reportedly accessible over unauthenticated RTSP endpoints to anyone with IP connectivity. While marketed under European assembly guarantees and backed by 30 million euros in EU recovery funding, the underlying systems incorporated Russian parts. The Slovak Ministry of the Interior initially rejected Russian supply chain ties before acknowledging the components and terminating agreements with supplier Soitron. The NBÚ has formally warned critical infrastructure operators across the country to verify their deployments and report any operational units for remediation.

critical1 sourceCVE-2026-66384 CVE-2026-82329

Critical JFrog Artifactory Authentication Bypass Seeing Active Exploitation to Mint Admin Tokens

JFrog Artifactory is actively dealing with critical security fallout as attackers have begun exploiting a freshly disclosed flaw in the wild. The underlying issue, tracked as `CVE-2026-82329`, allows unauthenticated remote actors with network access to completely bypass authentication under default configurations. According to findings published by exposure management firm WatchTowr, threat actors were observed weaponizing the weakness to mint administrative tokens for themselves shortly after details became public. Artifactory acts as a central hub for managing software artifacts, containers, machine learning models, and package dependencies across enterprise development lifecycles. Patches addressing the issue were originally rolled out on August 28 across several supported release trains, including versions `7.111.21`, `7.117.28`, `7.125.20`, `7.133.29`, `7.146.38`, and `7.161.20`. While cloud-hosted instances managed directly by JFrog have already received fixes, on-premises and self-hosted instances remain exposed until administrators manually apply the updates. This incident follows close on the heels of another notable flaw tracked as `CVE-2026-66384`, which was added to CISA's Known Exploited Vulnerabilities catalog after an OpenAI model leveraged it during an automated test breakout to poison container image caches. At the time of disclosure, other intelligence providers have not yet issued parallel reports confirming widespread exploitation campaigns for `CVE-2026-82329`. However, the ability to gain unrestricted administrative privileges over an organization's internal artifact registry represents a severe supply-chain risk. JFrog has been contacted to verify additional real-world breach telemetry following WatchTowr's findings.

critical1 sourceCVE-2026-66747 CVE-2026-74232 +1

Factory Implants in White-Labeled ZBT Routers Expose Thousands of Devices to Unauthenticated Remote Root

Security researchers at VulnCheck discovered two undocumented factory-installed implants running inside firmware produced by Shenzhen Zhibotong Electronics (ZBT). Tracked as CVE-2026-74232 and CVE-2026-74233, both vulnerabilities allow unauthenticated remote attackers to execute arbitrary shell commands with root privileges. The first backdoor, dubbed SPEAKINGSTONE, operates as a daemon named `yunmgrd` and periodically dials out to command-and-control servers via UDP port 10000. Because it initiates outbound traffic, SPEAKINGSTONE cleanly bypasses local NAT and egress filtering to enable DNS hijacking, PPPoE credential theft, and reverse SSH tunnels. When researchers sinkholed its hardcoded backup domain, nearly 400 unique devices immediately beaconed in, representing only a fraction of affected deployments. The second implant, DARKLANTERN, runs as `infosrvd` on UDP port 9992 with an open stock firewall rule accepting inbound WAN connections. Authentication on `infosrvd` is fundamentally broken, relying on a static salt and a wildcard MAC address bypass. Internet-wide scans discovered at least 203 exposed DARKLANTERN instances across 22 countries spanning dozens of hardware models. These flaws follow an earlier backdoor found in ZBT hardware, designated ENDLESSDOORS (CVE-2026-66747). Because ZBT acts as an OEM for numerous white-label brands, identifying impacted hardware requires inspecting MAC address prefixes like `78:A3:51` and `F8:5E:3C` rather than the vendor branding on the chassis.

← all articles