cve/2023/CVE-2023-1385.md

### [CVE-2023-1385](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1385)
![](https://img.shields.io/static/v1?label=Product&message=Fire%20TV%20Stick%203rd%20gen&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=TV%20with%20FireOS%20&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%206.2.9.4%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3D%207.6.3.2%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-330%20Use%20of%20Insufficiently%20Random%20Values&color=brighgreen)

### Description

Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authentication to amzn.lightning services.This issue affects:Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5.Insignia TV with FireOS 7.6.3.3.

### POC

#### Reference
- https://www.bitdefender.com/blog/labs/vulnerabilities-identified-amazon-fire-tv-stick-insignia-fire-os-tv-series/

#### Github
No PoCs found on GitHub currently.