Insignia TV with FireOS

• CVE-2023-1385 High 7.1 Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authentication to amzn.lightning services. This 0.3%
• CVE-2023-1384 Medium 4.3 The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be run This issue affects: Amazon Fire TV Stick 3rd gen ver 0.4%
• CVE-2023-1383 Medium 5.4 An Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr service allowed an attacker to register services that are only locally accessible. 0.3%