Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2023-1385

Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authentication to amzn.light

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Bitdefender

Description

Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authentication to amzn.lightning services. This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS 7.6.3.3.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Amazon Fire TV Stick 3rd gen

Default version status: unaffected

  • 6.2.9.4affected

Insignia TV with FireOS

Default version status: unaffected

  • 7.6.3.2affected

References