{"id":182505,"date":"2026-07-07T16:53:19","date_gmt":"2026-07-07T14:53:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/bekdor-v-proshivkah-tenda-pozvolyayushhij-poluchit-dostup-s-pravami-administratora"},"modified":"2026-07-07T16:53:19","modified_gmt":"2026-07-07T14:53:19","slug":"bekdor-v-proshivkah-tenda-pozvolyayushhij-poluchit-dostup-s-pravami-administratora","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/bekdor-v-proshivkah-tenda-pozvolyayushhij-poluchit-dostup-s-pravami-administratora","title":{"rendered":"Backdoor n\u00eb firmware-t e Tenda, q\u00eb lejon akses me privilegje administratori","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb firmware-t q\u00eb p\u00ebrdoren n\u00eb routerat, switch-at, pika t\u00eb qasjes pa telekom dhe sistemet e videov\u00ebzhgimit t\u00eb kompanis\u00eb Tenda, \u00ebsht\u00eb zbuluar nj\u00eb backdoor (CVE-2026-11405) q\u00eb lejon qasje n\u00eb nd\u00ebrfaqen web me t\u00eb drejta administratori duke anashkaluar procesin standard t\u00eb autentikimit dhe pa marr\u00eb parasysh cil\u00ebsimet e llogaris\u00eb s\u00eb administratorit. T\u00eb drejtat e ofruara lejojn\u00eb menaxhimin e t\u00eb gjitha cil\u00ebsimeve, manipulimin e trafik p\u00ebr t\u00eb \u00e7aktivizuar mjetet e mbrojtjes dhe p\u00ebrdorimin e pajisjes si nj\u00eb platform\u00eb p\u00ebr sulme n\u00eb sistemet n\u00eb rrjetin lokal. <\/p>\n
Problemi shkaktuar nga prania n\u00eb procesin \/bin\/httpd e funksionalitetit t\u00eb dokumentuar, i integruar n\u00eb funksionin login(). N\u00eb rast t\u00eb d\u00ebshtimit t\u00eb verifikimit t\u00eb zakonsh\u00ebm t\u00eb fjal\u00ebkalimit p\u00ebrmes hashes t\u00eb bazuar n\u00eb algoritmin MD5 p\u00ebr \u00e7do em\u00ebr p\u00ebrdoruesi, n\u00eb kod thirrej funksioni GetValue(\u201esys.rzadmin.password\u201c), i cili kontrollonte p\u00ebrputhjen e fjal\u00ebkalimit me vler\u00ebn e paracaktuar n\u00eb firmware n\u00eb m\u00ebnyr\u00eb t\u00eb qart\u00eb. N\u00eb rast t\u00eb p\u00ebrputhjes, pavar\u00ebsisht emrit t\u00eb p\u00ebrdoruesit t\u00eb specifikuar, krijohej nj\u00eb sesion me t\u00eb drejta administratori. <\/p>\n
P\u00ebr t\u00eb p\u00ebrdorur backdoor-in mjafton t\u00eb ket\u00eb qasje p\u00ebr t\u00eb d\u00ebrguar k\u00ebrkesa n\u00eb pajisje p\u00ebrmes HTTP ose HTTPS. Si mas\u00eb mbrojt\u00ebse rekomandohet ndalimi i qasjes n\u00eb serverin HTTP t\u00eb integruar n\u00eb firmware nga rrjetet e jashtme. <\/p>\n
Prania e problemit \u00ebsht\u00eb konfirmuar n\u00eb firmware-t: <\/p>\n