Improper JPAKE Implementation in Amazon Fire TV Stick and Insignia TV Allows Unauthorized Access

CVE-2023-1385

What is CVE-2023-1385?

The vulnerability arises from an improper implementation of JPAKE (Password Authenticated Key Exchange) in the affected devices, specifically allowing for offline brute-forcing of user PINs. Due to the initialization of random values to a known state, attackers can exploit this flaw to achieve unauthorized authentication, potentially compromising user accounts associated with Amazon services and allowing them access to sensitive features of the Fire TV Stick and Insignia TVs. This highlights the importance of robust security practices in implementing cryptographic protocols.

References