PT-2026-38435 · Optoma · Cinemax P2

Stefan · Published 2026-05-07 · Updated 2026-05-11 · CVE-2026-30496

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Optoma CinemaX P2 version TVOS-04.24.010.04.01

Description The device exposes an HTTP API on TCP port 2345 that allows full unauthenticated remote control. This API enables reading configuration across 74 endpoints and modifying settings such as volume, mute, brightness, power, display modes, and the enabling or disabling of network protocols, including TELNET. Any device on the same network can interact with these endpoints without authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-30496

Affected Products

Cinemax P2

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-30496 · Security Note
• https://twitter.com/lyrie_ai/status/2053763484186214588 · Twitter Post
• https://twitter.com/lyrie_ai/status/2053763485067079992 · Twitter Post
• https://whitelabel.org/security/2026-02-01-smart-projector · Note
• https://t.me/cveNotify/162821 · Telegram Post