CVE-2026-30496 describes a vulnerability in the Optoma CinemaX P2 projector firmware version TVOS-04.24.010.04.01 based on Android 8.0.0. The device exposes an HTTP API on TCP port 2345 that permits unauthenticated remote control over numerous projector functions. The API includes 74 endpoints for reading configuration and modifying settings such as volume, mute, brightness, power, network protocol enablement (including TELNET), and display modes. This lack of authentication allows any device on the same local network to control the projector without restriction.

An attacker with network access can remotely manipulate projector settings, potentially disrupting presentations or operations. They can change volume, mute/unmute, adjust brightness, power the device on or off, enable or disable network protocols including TELNET, and alter display modes. This could lead to denial of service, privacy issues, or unauthorized access via enabled protocols. The vulnerability does not require authentication, increasing the risk of exploitation within the local network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the projector by isolating it on a trusted network segment or using network controls to block TCP port 2345 from untrusted devices. Disable or limit network access to the projector where possible to prevent unauthorized control.