CVE-2026-30495
HighSummary
The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes Android Debug Bridge (ADB) on TCP port 5555 without requiring authentication. Additionally, a functional su binary exists that grants root privileges without authentication.
Risk Assessment
An attacker on the same network can connect to the device, escalate privileges, and gain complete control over it. This can lead to data theft, installation of persistent malware, and access to stored data.
Recommendation
It is recommended to disable ADB or configure it to require authentication and secure access to the device. Updating the firmware to the latest version is also advised to eliminate existing vulnerabilities.
Other vulnerabilities in Optoma CinemaX P2 projector
Original NVD description (English source)
The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes Android Debug Bridge (ADB) on TCP port 5555 over the network without requiring authentication. The device is configured with ro.adb.secure=0, which disables RSA key verification. Additionally, a functional su binary exists at /system/xbin/su that grants root privileges without authentication. An attacker on the same network can connect to the device via ADB, obtain a shell, and escalate to root privileges, gaining complete control of the device. This allows extraction of stored WiFi credentials, installation of persistent malware, and access to all device data.