CVE-2026-30495 affects the Optoma CinemaX P2 projector running firmware TVOS-04.24.010.04.01 based on Android 8.0.0. The device exposes ADB over the network on port 5555 with ro.adb.secure=0, disabling RSA key verification and allowing unauthenticated connections. Additionally, a su binary at /system/xbin/su grants root privileges without authentication. An attacker on the same network can connect via ADB, escalate privileges to root, and fully compromise the device, including extracting stored WiFi credentials and installing persistent malware.

An attacker with network access can gain unauthenticated root access to the device, resulting in complete compromise. This includes disclosure of sensitive information such as WiFi credentials, persistent malware installation, and full control over device data and functions. The vulnerability has a high CVSS score of 8.8, indicating severe confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device, especially blocking TCP port 5555, to prevent unauthorized ADB connections. Disable ADB over the network if possible. Monitor for unusual device behavior indicative of compromise.