CVE-2026-30496 describes a critical vulnerability in the Optoma CinemaX P2 projector firmware version TVOS-04.24.010.04.01 based on Android 8.0.0. The device exposes an HTTP API on TCP port 2345 that accepts unauthenticated requests from any device on the local network. This API includes 74 endpoints that allow both reading configuration data and writing/modifying key device settings such as volume, mute, brightness, power, network protocol toggles (including TELNET), and display modes. The lack of authentication enables full remote control of the projector by any local network user.

An attacker with network access can fully control the projector without any authentication, potentially disrupting presentations or media playback, changing device configurations, enabling insecure protocols like TELNET, or causing denial of service by powering off the device. The vulnerability impacts confidentiality, integrity, and availability of the device functions, as reflected by the CVSS score of 9.8 (critical).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the projector by isolating it on a trusted network segment or VLAN. Disable or block access to TCP port 2345 at the network perimeter or via firewall rules to prevent unauthorized local network access. Monitor for any unusual activity related to the projector on the network.