CVE-2026-30495: High severity Optoma CinemaX P2 vulnerability
The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes Android Debug Bridge (ADB) on TCP port 5555 over the network without requiring authentication. The device is configured with ro.adb.secure=0, which disables RSA key verification. Additionally, a functional su binary exists at /system/xbin/su that grants root privileges without authentication. An attacker on the same network can connect to the device via ADB, obtain a shell, and escalate to root privileges, gaining complete control of the device. This allows extraction of stored WiFi credentials, installation of persistent malware, and access to all device data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30495?
CVE-2026-30495 is considered a critical vulnerability due to the lack of authentication for the exposed Android Debug Bridge.
How do I fix CVE-2026-30495?
To fix CVE-2026-30495, disable ADB access over the network or secure ADB with authentication methods.
What devices are affected by CVE-2026-30495?
CVE-2026-30495 affects the Optoma CinemaX P2 projector running firmware TVOS-04.24.010.04.01 and Android 8.0.0.
What risks does CVE-2026-30495 pose to users?
CVE-2026-30495 can allow unauthorized access, potentially enabling attackers to exploit the projector or access sensitive data.
Is there a workaround for CVE-2026-30495?
A temporary workaround for CVE-2026-30495 is to disable network access to the device until a security patch is applied.