Skip to content
Sign in
7.1 High

CVE-2023-1385 Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known…

Description

Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authentication to amzn.lightning services. This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS 7.6.3.3.

Affected products and versions

Product Affected versions Fixed in
Fire TV Stick 3rd gen 6.2.9.4 No fix stated
TV with FireOS 7.6.3.2 No fix stated

Other CVEs of Fire TV Stick 3rd gen

The 2 CVEs of Fire TV Stick 3rd gen →
CVE-2023-1384 The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for… 4.3 Medium
Track this CVE