CVE-2026-30496: Critical severity Optoma CinemaX P2 vulnerability
The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes an HTTP API on TCP port 2345 that allows full unauthenticated remote control of the device. The API supports both reading configuration (74 endpoints) and writing/modifying settings including volume, mute, brightness, power, network protocols enable/disable (including TELNET), display modes, and other projector functions. Any device on the same network can control the projector without authentication.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30496?
CVE-2026-30496 is classified as a high severity vulnerability due to its potential for unauthenticated remote control of the device.
How do I fix CVE-2026-30496?
To fix CVE-2026-30496, update the Optoma CinemaX P2 projector to the latest firmware version that addresses this vulnerability.
What are the risks associated with CVE-2026-30496?
The risks associated with CVE-2026-30496 include unauthorized access and control over the projector's settings and functionalities.
Is CVE-2026-30496 limited to specific firmware versions?
Yes, CVE-2026-30496 specifically affects the Optoma CinemaX P2 projector running firmware TVOS-04.24.010.04.01 and Android 8.0.0.
Can CVE-2026-30496 be exploited from the internet?
Yes, CVE-2026-30496 can be exploited from the internet if the projector is exposed to external networks.