N\u00eb pajisjet Bluetooth q\u00eb p\u00ebrdorin SoC nga kompania Airoha Systems, jan\u00eb zbuluar vulnerabilitete q\u00eb lejojn\u00eb marrjen e kontrollit mbi pajisjen n\u00ebp\u00ebrmjet d\u00ebrgimit t\u00eb t\u00eb dh\u00ebnave t\u00eb ve\u00e7anta p\u00ebrmes Bluetooth Classic ose BLE (Bluetooth Low Energy). Sulmi mund t\u00eb kryhet pa autentifikim dhe pa lidhje paraprake, p\u00ebr aq koh\u00eb sa pajisja e viktim\u00ebs \u00ebsht\u00eb brenda arritjes s\u00eb sinjalit Bluetooth (af\u00ebrsisht 10 metra). Vulnerabilitetet prekin disa modele kufjesh pa tela, altoparlant\u00ebsh dhe mikrofon\u00ebsh nga Sony, Marshall, Beyerdynamic dhe kompani m\u00eb pak t\u00eb njohura. <\/p>\n
Hulumtuesit q\u00eb zbuluan vulnerabilitetin ishin n\u00eb gjendje t\u00eb p\u00ebrgatisin nj\u00eb prototip t\u00eb nj\u00eb mjeti q\u00eb lejon leximin dhe shkrimin e t\u00eb dh\u00ebnave n\u00eb kujtes\u00ebn operuese dhe Flash n\u00eb m\u00ebnyr\u00eb t\u00eb larg\u00ebt p\u00ebrmes Bluetooth. N\u00eb praktik\u00eb, marrja e aksesit t\u00eb plot\u00eb n\u00eb kujtes\u00ebn e kufjeve mund t\u00eb p\u00ebrdoret p\u00ebr nj\u00eb sulm ndaj telefonit t\u00eb lidhur me kufjet e p\u00ebrdoruesit. N\u00eb ve\u00e7anti, p\u00ebrmendet se p\u00ebrmes nd\u00ebrveprimit t\u00eb kufjeve me telefonin, mund t\u00eb fitohet qasje n\u00eb p\u00ebrmbajtjen e adresarit, t\u00eb nxirren histori telefonat dhe t\u00eb kryhen thirrje ose t\u00eb d\u00ebgjohen bisedat ose tingujt e kapur nga mikrofoni. <\/p>\n
P\u00ebr nd\u00ebrveprimin me telefonin nga kufjet e kompromentuara p\u00ebrdoren mund\u00ebsit\u00eb e profilit Bluetooth HFP (Hands-Free Profile), i cili lejon d\u00ebrgimin e komandeve n\u00eb telefon. P\u00ebr shkak t\u00eb kompleksitetit t\u00eb shfryt\u00ebzimit t\u00eb vulnerabiliteteve, mund t\u00eb supozohet se problemet do t\u00eb k\u00ebrkohen p\u00ebr t\u00eb kryer sulme t\u00eb synuara ndaj individ\u00ebve t\u00eb ve\u00e7ant\u00eb, dhe jo p\u00ebr p\u00ebrdorim masiv kund\u00ebr p\u00ebrdoruesve t\u00eb zakonsh\u00ebm. Problemi \u00ebsht\u00eb se mjeti p\u00ebr kryerjen e sulmit duhet t\u00eb implementohet p\u00ebr \u00e7do model t\u00eb ve\u00e7ant\u00eb t\u00eb kufjeve, pasi \u00ebsht\u00eb e nevojshme t\u00eb merret parasysh ndryshimi i disponimit t\u00eb kujtes\u00ebs n\u00eb secil\u00ebn firmware. <\/p>\n
Kryerja e sulmit \u00ebsht\u00eb e mundur fal\u00eb zbules\u00ebs s\u00eb tre vulnerabiliteteve n\u00eb stakun Bluetooth t\u00eb Airoha. Vulnerabilitetet CVE-2025-20700 dhe CVE-2025-20701 lejojn\u00eb vendosjen e nj\u00eb kanali komunikimi me Bluetooth BR\/EDR (Bluetooth Classic) dhe sh\u00ebrbimet GATT (Bluetooth Low Energy) pa kaluar autentifikimin, nd\u00ebrsa vulnerabiliteti CVE-2025-20702 lejon aktivizimin e protokollit t\u00eb avancuar t\u00eb ve\u00e7ant\u00eb p\u00ebr SoC Airoha p\u00ebr manipulimin e pajisjes. Hulumtuesit zbuluan se protokolli sh\u00ebrbim i avancuar, midis gj\u00ebrave t\u00eb tjera lejon leximin dhe shkrimin e t\u00eb dh\u00ebnave n\u00eb RAM dhe Flash, \u00ebsht\u00eb i disponuesh\u00ebm pa lidhje t\u00eb pajisjeve p\u00ebrmes BLE GATT ose Bluetooth Classic RFCOMM. <\/p>\n
Informacioni mbi qasjet e dob\u00ebsive u d\u00ebrgua n\u00eb kompanin\u00eb Airoha m\u00eb 25 mars, por p\u00ebrgjigjen arriti ta merrte vet\u00ebm m\u00eb 27 maj pas disa tentativave t\u00eb p\u00ebrs\u00ebritura p\u00ebr t'u lidhur me Airoha dhe p\u00ebrfshirjes s\u00eb disa prodhuesve t\u00eb pajisjeve. M\u00eb 4 qershor, Airoha filloi t\u00eb shp\u00ebrndaj\u00eb mes prodhuesve nj\u00eb SDK t\u00eb p\u00ebrdit\u00ebsuar, q\u00eb p\u00ebrmban mund\u00ebsi p\u00ebr bllokimin e dob\u00ebsive. N\u00eb fund t\u00eb qershorit, pas skadimit t\u00eb 90 dit\u00ebve nga d\u00ebrgimi i informacionit mbi problemin, studiuesit publikuan informacione t\u00eb p\u00ebrgjithshme mbi dob\u00ebsit\u00eb, por vendos\u00ebn t\u00eb mos zbulojn\u00eb ende detajet q\u00eb lidhen me protokollin problematik, p\u00ebr t'u dh\u00ebn\u00eb prodhuesve koh\u00eb t\u00eb mjaftueshme p\u00ebr shp\u00ebrndarjen e p\u00ebrdit\u00ebsimeve t\u00eb softuerit. <\/p>\n
Pajisjet p\u00ebr t\u00eb cilat jan\u00eb konfirmuar dob\u00ebsit\u00eb n\u00eb shqyrtim: <\/p>\n