Optoma CinemaX Critical Vulnerabilities: Unauthenticated ADB Root Access & Control API

Critical Vulnerabilities Summary for Optoma CinemaX Projectors Vulnerability Overview Optoma CinemaX projectors contain two critical security vulnerabilities that allow attackers to gain device control without authentication within the same network: 1. CVE-2020-30495 (CVSS 9.6 Critical): Unauthenticated remote root access. The device exposes ADB (Android Debug Bridge) on port 5555, allowing attackers to directly obtain root privileges. 2. CVE-2020-30496 (CVSS 6.3 Medium): Unauthenticated remote control API. The device exposes an HTTP API on port 2345, allowing attackers to arbitrarily modify settings such as volume and mute status. Scope of Impact Affected Models: CinemaX P2 (X1VDPTHG) is confirmed affected; CinemaX P1 / UHZ65UST and CinemaX Pro may also be affected. Affected Firmware Versions: All reported firmware versions are vulnerable. Current Status: The patch released by Optoma only fixes the ADB vulnerability and does not address the control API vulnerability. Furthermore, the patch is not pushed via automatic updates. Remediation Steps 1. Disconnect from Network: If online features are not required, disconnect the network connection directly (most effective). 2. Manual Firmware Update: Download and manually install the firmware released by Optoma in March 2026 (this only fixes the ADB vulnerability). 3. Network Isolation: Place the projector on a separate VLAN or guest network. 4. Avoid Shared Networks: Do not use the device on shared networks such as those in hotels or offices. 5. Disable Network Features: If Alexa integration or remote control is not needed, disable these features. 6. Firewall Restrictions: Block outbound traffic on the firewall. POC Code ADB Root Access (CVE-2020-30495): Remote Control API (CVE-2020-30496):**

Goal Reached Thanks to every supporter — we hit 100%!

Optoma CinemaX Critical Vulnerabilities: Unauthenticated ADB Root Access & Control API