EUVD-2026-28367
GHSA-mm28-jjfm-w9mv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated LAN-reachable API gives full write control (I:H) and power-off (A:H); confidentiality lowered to C:L as exposed data is operational projector config, not sensitive data.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes an HTTP API on TCP port 2345 that allows full unauthenticated remote control of the device. The API supports both reading configuration (74 endpoints) and writing/modifying settings including volume, mute, brightness, power, network protocols enable/disable (including TELNET), display modes, and other projector functions. Any device on the same network can control the projector without authentication.
AnalysisAI
Unauthenticated remote control of the Optoma CinemaX P2 smart projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) is possible through an HTTP API listening on TCP port 2345. Any host on the same network can read 74 configuration endpoints and write settings including power, volume, brightness, display mode, and network protocol toggles - notably enabling TELNET, which can widen the attack surface. No public exploit identified at time of analysis, and EPSS is very low (0.02%), but the flaw requires no credentials and CVSS is rated 9.8.
Technical ContextAI
The device is an Android 8.0.0-based smart projector (Optoma's TVOS platform) that ships a management HTTP API on the non-standard TCP port 2345. Per CWE-285 (Improper Authorization), the root cause is that this API performs no authorization or authentication check before honoring read and write commands, so state-changing operations are exposed to any network peer. Because one of the writable settings enables TELNET (and other network protocols), successful abuse is not limited to nuisance control - it can be chained to open a legacy remote-shell service on the device. The CPE string provided by the source is a placeholder (cpe:2.3:a:n/a:n/a:*), so exact affected-product matching must come from the vendor firmware string in the description rather than from structured CPE data.
RemediationAI
No vendor-released patch identified at time of analysis, so rely on compensating controls. Primary mitigation is network segmentation: place the projector on an isolated management or IoT VLAN and block ingress to TCP port 2345 from user and guest networks via a firewall or switch ACL, which stops the unauthenticated API from being reached while preserving legitimate control from an authorized host. Explicitly confirm and keep TELNET (and other optional network protocols) disabled, since the API can toggle it on; monitor the device for unexpected protocol changes. If projector network control is not required, disable the device's network interface entirely, accepting loss of remote/app management as a trade-off. Check the vendor's support channel and the researcher advisory (https://whitelabel.org/security/2026-02-01-smart-projector/) for firmware updates before deploying, and re-test port 2345 reachability after any change.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today