Input validation

Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authentication to amzn.lightning services. This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with...

CVE-2023-1385

Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authentication to amzn.lightning services. This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with...

CVE-2023-1385

Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authentication to amzn.lightning services. This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with...

CVE-2023-1385

CVE-2023-1385 describes an improper JPAKE implementation that allows offline PIN brute-forcing due to initializing random values to a known value, enabling unauthorized authentication to amzn.lightning services. Affected: Amazon Fire TV Stick 3rd gen before 6.2.9.5 and Insignia TV with FireOS 7.6...

CVE-2023-1383

An Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr service allowed an attacker to register services that are only locally accessible. This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with Fire...

Input validation

An Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr service allowed an attacker to register services that are only locally accessible. This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with Fire...

CVE-2023-1384

The CVE-2023-1384 issue affects Amazon Fire TV Stick 3rd-gen devices (pre-6.2.9.5) and Insignia FireOS TVs (pre-7.6.3.3). The root cause is improper sanitization of the source parameter in the setMediaSource function of the amzn.thin.pl service, which can allow arbitrary JavaScript execution. Rem...

CVE-2023-1384

The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be run This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS versions prior to 7.6.3.3...

CVE-2023-1384

The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be run This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS versions prior to 7.6.3.3...

CVE-2023-1383

An Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr service allowed an attacker to register services that are only locally accessible. This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with Fire...

CVE-2023-1383

CVE-2023-1383 involves an improper enforcement of a behavioral workflow in the exchangeDeviceServices function of the amzn.dmgr service. Public documents specify affected devices: Amazon Fire TV Stick (3rd gen) before 6.2.9.5 and Insignia TV with FireOS before 7.6.3.3. The vulnerability enables a...

CVE-2023-1383

An Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr service allowed an attacker to register services that are only locally accessible. This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with Fire...

Amazon Fire TV Stick security vulnerabilities

The Amazon Fire TV Stick is a TV voice recognition remote control from Amazon.com, Inc. A security vulnerability exists in the Amazon Fire TV Stick that stems from improper workflow execution of the exchangeDeviceServices function of the amzn.dmgr service...

PT-2023-16947 · Amazon +1 · Fire Os +2

Name of the Vulnerable Software and Affected Versions: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5 Insignia TV with FireOS version 7.6.3.3 Description: The issue is related to an improper JPAKE implementation, which allows offline PIN brute-forcing due to the initialization of random...

PT-2023-16945 · Amazon +1 · Amazon Fire Tv Stick +1

Name of the Vulnerable Software and Affected Versions: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5 Insignia TV with FireOS versions prior to 7.6.3.3 Description: An issue with the exchangeDeviceServices function on the amzn.dmgr service allowed an attacker to register services that are...

PT-2023-16946 · Amazon +1 · Amazon Fire Tv Stick +1

Name of the Vulnerable Software and Affected Versions: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5 Insignia TV with FireOS versions prior to 7.6.3.3 Description: The issue is related to the setMediaSource function on the amzn.thin.pl service, which does not properly sanitize the source...

CVE-2023-1385: Use of Insufficiently Random Values

Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authentication to amzn.lightning services. This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with...

CVE-2023-1384: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be run This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS versions prior to 7.6.3.3...

CVE-2023-1383: Improper Enforcement of Behavioral Workflow

An Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr service allowed an attacker to register services that are only locally accessible. This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with Fire...

Amazon Fire TV Stick cross-site scripting vulnerability

The Amazon Fire TV Stick is a TV voice recognition remote control from Amazon.com, Inc. A security vulnerability exists in the Amazon Fire TV Stick that stems from the setMediaSource function on the amzn.thin.pl service not being cleaned up...