CVE-2023-1385

HIGH

Amazon Fire TV Stick <6.2.9.5 - Auth Bypass

Title source: llm

Description

Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authentication to amzn.lightning services. This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS 7.6.3.3.

References (1)

[Third Party Advisory] https://www.bitdefender.com/blog/labs/vulnerabilities-identified-amazon-fire-tv-stick-insignia-fire-os-tv-series/

Scores

CVSS v3 7.1

EPSS 0.0005

EPSS Percentile 14.5%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Classification

CWE

CWE-330

Status published

Affected Products (1)

amazon/fire_os < 6.2.9.5

Timeline

Published May 03, 2023

Tracked Since Feb 18, 2026