This vulnerability affects the Optoma CinemaX P2 projector firmware TVOS-04.24.010.04.01 based on Android 8.0.0. The device exposes ADB on TCP port 5555 without authentication due to the configuration ro.adb.secure=0, which disables RSA key verification. Additionally, a su binary located at /system/xbin/su allows privilege escalation to root without authentication. An attacker on the local network can exploit these weaknesses to gain root shell access, compromising device confidentiality and integrity by extracting stored WiFi credentials, installing malware, and accessing all device data.

An attacker with network access to the device can gain unauthenticated root shell access via ADB. This leads to complete compromise of the device, including extraction of sensitive WiFi credentials, installation of persistent malware, and full access to all stored data. The vulnerability undermines device security and privacy, potentially enabling further network attacks or persistent footholds.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device to trusted users only and disable ADB over the network if possible. Monitor for any vendor updates addressing this vulnerability.