EUVD-2026-28366
GHSA-q5p3-6vwg-rf7j
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes Android Debug Bridge (ADB) on TCP port 5555 over the network without requiring authentication. The device is configured with ro.adb.secure=0, which disables RSA key verification. Additionally, a functional su binary exists at /system/xbin/su that grants root privileges without authentication. An attacker on the same network can connect to the device via ADB, obtain a shell, and escalate to root privileges, gaining complete control of the device. This allows extraction of stored WiFi credentials, installation of persistent malware, and access to all device data.
AnalysisAI
Unauthenticated remote root access on Optoma CinemaX P2 smart projectors allows network attackers to execute arbitrary code with full system privileges. The device ships with ADB enabled on TCP 5555 without authentication (ro.adb.secure=0) and contains an unrestricted su binary, enabling complete device compromise including WiFi credential theft, malware installation, and data exfiltration. EPSS score (0.02%, 6th percentile) indicates low widespread exploitation probability, though SSVC framework assesses total technical impact. No public exploit code or active exploitation confirmed at time of analysis.
Technical ContextAI
Android Debug Bridge (ADB) is a developer tool intended for local USB debugging of Android devices. This projector runs Android 8.0.0 (TVOS-04.24.010.04.01 firmware) with ADB misconfigured to listen on network interface TCP port 5555 with the ro.adb.secure property set to 0, which disables RSA public key authentication normally required for remote ADB connections. The device further includes a functional su (superuser) binary at /system/xbin/su without authentication gates, violating the principle of least privilege. CWE-285 (Improper Authorization) reflects this architectural failure where critical system access lacks proper access controls. The combination creates a privilege escalation chain from network access directly to root without intermediate authentication barriers, representing a fundamental security design flaw in embedded Android deployments.
RemediationAI
No vendor-released patch identified at time of analysis. Optoma has not published a security advisory or firmware update addressing this vulnerability per available references. Immediate compensating controls: Isolate affected projectors on dedicated VLAN with strict firewall rules blocking inbound TCP port 5555 from untrusted networks (note: this breaks legitimate remote management if used). Disable WiFi connectivity and use wired-only connections with network ACLs restricting access to authorized management stations only (trade-off: eliminates wireless casting features). For enterprise deployments, implement network admission control (NAC) to prevent unauthorized devices from reaching projector network segments (requires infrastructure investment). Monitor network traffic for ADB connections (TCP 5555) to detect exploitation attempts. Contact Optoma technical support referencing CVE-2026-30495 to request patched firmware and inquire about product lifecycle status. Consider device replacement if vendor confirms end-of-support status, as authentication bypass vulnerabilities in embedded devices cannot be mitigated through external controls alone when the device is network-accessible. Full advisory available at https://whitelabel.org/security/2026-02-01-smart-projector/ and NVD reference https://nvd.nist.gov/vuln/detail/CVE-2026-30495.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today