PT-2026-38434 · Optoma · Cinemax P2

Stef + 1 · Published 2026-05-07 · Updated 2026-05-08 · CVE-2026-30495

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Optoma CinemaX P2 version TVOS-04.24.010.04.01

Description The device exposes Android Debug Bridge (ADB) on TCP port 5555 over the network without authentication. It is configured with the variable ro.adb.secure set to 0, which disables RSA key verification. Furthermore, a functional su binary located at /system/xbin/su grants root privileges without authentication. An attacker on the same network can connect via ADB to obtain a shell and escalate to root privileges, allowing for the extraction of stored WiFi credentials, installation of persistent malware, and full access to device data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-30495

Affected Products

Cinemax P2

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-30495 · Security Note
• https://t.me/cveNotify/162820 · Telegram Post
• https://whitelabel.org/security/2026-02-01-smart-projector · Note