What is the CVSS score of CVE-2026-30495?

CVE-2026-30495 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Optoma CinemaX P2 are affected by CVE-2026-30495?

CVE-2026-30495 affects Optoma CinemaX P2 projectors with a critical remote root vulnerability allowing unauthenticated network attackers to gain complete system control, install malware, and…

How to fix or mitigate CVE-2026-30495?

Within 24 hours: Identify and inventory all Optoma CinemaX P2 projectors on your network using asset management tools and network scanning; isolate affected devices to a separate VLAN or air-gapped network segment. Within 7 days: Contact Optoma support to confirm patch availability timeline; implement network access controls restricting TCP 5555 at the firewall; disable WiFi and network connectivity on CinemaX P2 units if operationally feasible or restrict to trusted wired networks only. Within 30 days: Evaluate replacement with patched projector models; document all CinemaX P2 locations and apply continuous monitoring for unauthorized administrative access attempts; conduct credential rotation for any WiFi networks accessible from affected projectors.

Optoma CinemaX P2 CVE-2026-30495

EUVD-2026-28366 HIGH

Improper Authorization (CWE-285)

2026-05-07 mitre

GHSA-q5p3-6vwg-rf7j

Authentication Bypass Google N A

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 09, 2026 - 01:32 vuln.today

CVSS changed

May 08, 2026 - 23:22 NVD

8.8 (None) 8.8 (HIGH)

CVE Published

May 07, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

CVE Published

May 07, 2026 - 00:00 nvd

HIGH 8.8

DescriptionCVE.org

The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes Android Debug Bridge (ADB) on TCP port 5555 over the network without requiring authentication. The device is configured with ro.adb.secure=0, which disables RSA key verification. Additionally, a functional su binary exists at /system/xbin/su that grants root privileges without authentication. An attacker on the same network can connect to the device via ADB, obtain a shell, and escalate to root privileges, gaining complete control of the device. This allows extraction of stored WiFi credentials, installation of persistent malware, and access to all device data.

AnalysisAI

Unauthenticated remote root access on Optoma CinemaX P2 smart projectors allows network attackers to execute arbitrary code with full system privileges. The device ships with ADB enabled on TCP 5555 without authentication (ro.adb.secure=0) and contains an unrestricted su binary, enabling complete device compromise including WiFi credential theft, malware installation, and data exfiltration. EPSS score (0.02%, 6th percentile) indicates low widespread exploitation probability, though SSVC framework assesses total technical impact. No public exploit code or active exploitation confirmed at time of analysis.

Technical ContextAI

Android Debug Bridge (ADB) is a developer tool intended for local USB debugging of Android devices. This projector runs Android 8.0.0 (TVOS-04.24.010.04.01 firmware) with ADB misconfigured to listen on network interface TCP port 5555 with the ro.adb.secure property set to 0, which disables RSA public key authentication normally required for remote ADB connections. The device further includes a functional su (superuser) binary at /system/xbin/su without authentication gates, violating the principle of least privilege. CWE-285 (Improper Authorization) reflects this architectural failure where critical system access lacks proper access controls. The combination creates a privilege escalation chain from network access directly to root without intermediate authentication barriers, representing a fundamental security design flaw in embedded Android deployments.

RemediationAI

No vendor-released patch identified at time of analysis. Optoma has not published a security advisory or firmware update addressing this vulnerability per available references. Immediate compensating controls: Isolate affected projectors on dedicated VLAN with strict firewall rules blocking inbound TCP port 5555 from untrusted networks (note: this breaks legitimate remote management if used). Disable WiFi connectivity and use wired-only connections with network ACLs restricting access to authorized management stations only (trade-off: eliminates wireless casting features). For enterprise deployments, implement network admission control (NAC) to prevent unauthorized devices from reaching projector network segments (requires infrastructure investment). Monitor network traffic for ADB connections (TCP 5555) to detect exploitation attempts. Contact Optoma technical support referencing CVE-2026-30495 to request patched firmware and inquire about product lifecycle status. Consider device replacement if vendor confirms end-of-support status, as authentication bypass vulnerabilities in embedded devices cannot be mitigated through external controls alone when the device is network-accessible. Full advisory available at https://whitelabel.org/security/2026-02-01-smart-projector/ and NVD reference https://nvd.nist.gov/vuln/detail/CVE-2026-30495.