CVE-2026-30496

9.8 Critique

Publiée le 07/05/2026 à 16:16 · Modifiée le 17/06/2026 à 12:32 · En attente d'analyse NVD · Source : cve@mitre.org

Description

The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes an HTTP API on TCP port 2345 that allows full unauthenticated remote control of the device. The API supports both reading configuration (74 endpoints) and writing/modifying settings including volume, mute, brightness, power, network protocols enable/disable (including TELNET), display modes, and other projector functions. Any device on the same network can control the projector without authentication.

Traduire en français

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-285

Références

https://whitelabel.org/security/2026-02-01-smart-projector/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories