CVE-2023-1385

CVE-2023-1385 describes an improper JPAKE implementation in Amazon Fire TV Stick 3rd gen (versions prior to 6.2.9.5) and Insignia TVs with FireOS 7.6.3.3. This flaw allows for offline PIN brute-forcing due to predictable random value initialization, leading to unauthorized authentication to amzn.lightning services. The vulnerability is rated with a CVSS score of 8.8 (HIGH), indicating a severe risk. It can be exploited with low attack complexity over an adjacent network without user interaction, potentially leading to high confidentiality, integrity, and availability impacts. Currently, there is no evidence of active exploitation, nor is exploit code publicly available on platforms like Metasploit or ExploitDB. Community discussion and media coverage around this CVE are minimal, suggesting low public awareness at this time.