Pro-me3us Tool Roots Fire TV Cube 3 Via Bootloader Flaw, Wipes Data and Risks Bricking on PS7717

A new exploit package enables persistent root access and bootloader unlocking on Amazon’s third-generation Fire TV Cube. Released by XDA developer Pro-me3us, the tool affects devices running firmware version PS7717 or older.

What happened

XDA developer Pro-me3us released a public exploit package that targets Amazon Fire TV Cube 3 devices, known internally as "gazelle". According to Cyber Security News, the tool allows users to gain persistent root access and unlock the bootloader on firmware version PS7717 or older. The project combines a temporary privilege escalation method with a separate bootloader vulnerability to enable deep system modifications.

The process begins with Android Debug Bridge access, requiring users to enable debugging and authorize the connection. A temporary root tool provides the necessary permissions for the unlock script to execute. The device then restarts into TWRP recovery to complete the changes before returning to FireOS. The developer warns that this procedure can permanently brick the device and performs an automatic factory reset. It also requires 1.5GB of user storage to maintain the unlocked state.

Version 1.2 of the package, dated September 30, 2026, extends the temporary root tool to support firmware PS7717/5741. This update includes Magisk version 30.7 and a local ADB fix. The package credits mforce2 for porting the GhostLock exploit, associated with CVE-2026-43499, and NebuSec for the original exploit chain. John Red is credited with finding the bootloader vulnerability, while Pro-me3us integrated the components.

Why it matters

Once unlocked, the Fire TV Cube gains Magisk support and TWRP recovery features. According to GBHackers, the package removes restrictions on Fastboot and Amlogic download mode. It also exposes the U-Boot command line via Ethernet netconsole and enables booting from USB storage. These changes allow owners to install custom kernels, modify system partitions, and run alternative operating systems.

Users can deploy CoreELEC for Kodi-based media playback or EmuELEC for retro gaming. The capabilities support multiboot configurations using internal eMMC storage or external USB media. This transforms the streaming device into a flexible platform for testing and personal use. However, the permanent nature of the bootloader unlock and the risk of bricking pose significant operational risks for enterprise or managed devices.

The project acknowledges researcher Man Yue Mo’s earlier work on Mali GPU vulnerabilities, specifically CVE-2022-38181 and CVE-2022-46395. These flaws served as a basis for information gathering and testing rather than the active exploitation mechanism in this package. Cyber Security News notes that low-level driver bugs in Mali GPUs can enable device takeover, though those specific vulnerabilities are not the primary vector here.

Our take on the response

The release of this tool highlights the fragility of bootloader security in consumer streaming devices. That suggests vendors need to strengthen secure boot implementations to prevent unauthorized code execution. The public availability of the exploit means any device on affected firmware versions is vulnerable to persistent compromise. Organizations should audit their inventory for affected models and firmware levels immediately.

What to do and how to stay safe: Amazon Fire TV Cube 3

• Disable Android Debug Bridge and USB debugging on all Fire TV devices to prevent unauthorized local access.
• Monitor network traffic for unusual connections to U-Boot netconsole or Amlogic download mode interfaces.
• Keep devices updated to firmware versions newer than PS7717 once Amazon releases a patch.
• Isolate streaming devices from sensitive network segments to limit lateral movement if compromised.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which firmware versions are affected by this exploit?

The exploit targets Amazon Fire TV Cube 3 devices running firmware version PS7717 or older, including the PS7717/5741 build.

Does this exploit use CVE-2022-38181 or CVE-2022-46395?

No, those Mali GPU vulnerabilities were used for earlier testing and information gathering, not as the active exploitation mechanism in this package.

What are the risks of using this unlock tool?

The process can permanently brick the device, automatically erases all user data, and requires 1.5GB of storage to maintain the unlock.