Threats tagged 'ghsa-q5p3-6vwg-rf7j'

The Optoma CinemaX P2 projector with firmware TVOS-04.24.010.04.01 running Android 8.0.0 exposes the Android Debug Bridge (ADB) service on TCP port 5555 without requiring authentication. The device disables RSA key verification for ADB, and includes a su binary that grants root access without authentication. An attacker on the same network can connect via ADB, gain a shell, escalate to root, and fully control the device, including extracting WiFi credentials and installing persistent malware.