The Optoma CinemaX P2 projector

CVE-2026-30496 is an unauthenticated control surface on the Optoma CinemaX P2 exposed over HTTP on TCP/2345. On confirmed vulnerable firmware TVOS-04.24.010.04.01 running Android 8.0.0, any host on the same local network can read settings and issue write operations across 74 endpoints, including power, volume, mute, brightness, display modes, and protocol toggles such as TelnetOn; the reporting researcher also notes likely exposure in sibling models sharing the same firmware platform, including CinemaX P1 / UHZ65UST and CinemaX Pro.

The vendor-style 9.8/CRITICAL framing does not match how this lands in real enterprise environments. The biggest friction is attacker position: this is same-network control of a projector, not unauthenticated internet-reachable server takeover, and the observed impact is device control/disruption rather than domain-wide compromise; that pushes this down to a MEDIUM operational-security issue unless your AV gear sits on flat user VLANs or hostile guest networks.

Why this verdict

• Major downward pressure: requires same-network access. The advisory and NVD text both describe control by any device on the same network, which implies internal foothold, shared Wi-Fi, guest access, or flat AV segmentation—not the classic internet-exposed unauthenticated server case implied by a 9.8 label.
• Blast radius is usually one device, one room. Even full control here mostly means nuisance, outage, or local AV sabotage; it is not demonstrated domain compromise, server takeover, or tenant-wide data loss.
• Threat telemetry is weak. EPSS is extremely low, KEV is negative, and I found no reviewed evidence of active campaigns or meaningful internet-scale scanning tied to this CVE.
• But it is still not LOW. No authentication is required, the API is deterministic and easy to script with curl, and there is no identified vendor fix, so exposed projectors on user-accessible networks will absolutely get abused by bored insiders or post-compromise operators.

Why not higher?

There is no solid evidence of widespread external exposure, active exploitation, or reliable escalation from projector control to broader enterprise compromise. The requirement for local-network reachability is the compounding friction that breaks the vendor's CRITICAL story.

Why not lower?

This is not harmless information leakage. The API allows unauthenticated state changes across dozens of functions, including power, audio, image, and protocol settings, and the lack of a vendor fix means the risk persists wherever the device remains reachable.

1. Isolate projector networks — Move Optoma projectors onto a dedicated AV VLAN with ACLs that only permit approved control stations; block user, guest, and server subnets from reaching TCP/2345. For a MEDIUM finding there is no noisgate mitigation SLA, so do this as operational hardening rather than emergency break-fix.
2. Block TCP/2345 east-west — Write explicit firewall rules to deny access to port 2345/tcp except from named management hosts if business use truly requires it. This is the fastest way to kill the unauthenticated control path when no vendor patch is available.
3. Remove unnecessary network access — If the projector only receives HDMI input, disconnect Wi-Fi/Ethernet entirely. That closes the exposure completely and is often the cleanest answer for conference-room and signage deployments.
4. Inventory and tag exposed Optoma units — Find devices with Optoma banners, MAC OUIs, or open 2345/tcp, then tag them as exception-managed IoT/AV assets. Use that inventory to drive replacement or segmentation within the 365-day remediation window for this MEDIUM verdict.
5. Monitor for projector API traffic — Alert on internal HTTP requests to :2345 and especially PUT /set/ patterns. This will not prevent abuse, but it gives you detection for insider misuse and post-compromise east-west activity.

Run this from an auditor workstation on the same network path as the projector, not on the projector itself. Invoke it as bash check_optoma_2345.sh 192.168.1.30; it needs no credentials and no root, only outbound TCP access to the target on port 2345.

#!/usr/bin/env bash
# check_optoma_2345.sh
# Verifies whether an Optoma projector exposes the unauthenticated TCP/2345 control API.
# Usage: bash check_optoma_2345.sh <ip-or-hostname>
# Exit codes:
#   0 = VULNERABLE
#   1 = PATCHED
#   2 = UNKNOWN / error

set -u

TARGET="${1:-}"
PORT="2345"
TIMEOUT="5"

if [[ -z "$TARGET" ]]; then
  echo "Usage: bash $0 <ip-or-hostname>"
  echo "UNKNOWN"
  exit 2
fi

need_cmd() {
  command -v "$1" >/dev/null 2>&1
}

if ! need_cmd curl; then
  echo "curl is required"
  echo "UNKNOWN"
  exit 2
fi

# Basic reachability test
if need_cmd nc; then
  nc -z -w "$TIMEOUT" "$TARGET" "$PORT" >/dev/null 2>&1
  NC_RC=$?
  if [[ $NC_RC -ne 0 ]]; then
    echo "PATCHED"
    exit 1
  fi
fi

# Non-destructive read tests first
URLS=(
  "http://${TARGET}:${PORT}/get/Volume"
  "http://${TARGET}:${PORT}/get/ProjectorID"
  "http://${TARGET}:${PORT}/get/Mute"
)

for url in "${URLS[@]}"; do
  body_file=$(mktemp)
  code=$(curl -m "$TIMEOUT" -sS -o "$body_file" -w "%{http_code}" "$url" 2>/dev/null)
  rc=$?
  if [[ $rc -eq 0 && "$code" == "200" ]]; then
    body=$(tr -d '\r' < "$body_file" | head -c 128)
    rm -f "$body_file"
    # The published API returns simple scalar values like 0, 1, 93, etc.
    if [[ "$body" =~ ^-?[0-9]+$ ]]; then
      echo "VULNERABLE"
      exit 0
    fi
  fi
  rm -f "$body_file"
done

# If port is open but read probes fail, status is unclear.
# It may be filtered, a different service, or behavior may differ by model/firmware.
if need_cmd nc; then
  echo "UNKNOWN"
  exit 2
fi

# Fallback if nc was unavailable: infer from curl connectivity failures.
body_file=$(mktemp)
code=$(curl -m "$TIMEOUT" -sS -o "$body_file" -w "%{http_code}" "http://${TARGET}:${PORT}/" 2>/dev/null)
rc=$?
rm -f "$body_file"
if [[ $rc -ne 0 ]]; then
  echo "PATCHED"
  exit 1
fi

echo "UNKNOWN"
exit 2

Sources

1. NVD CVE-2026-30496
2. whitelabel advisory
3. whitelabel endpoint inventory
4. Optoma support: projector webpage/control access
5. Optoma Europe March 19 2026 CinemaX P2 release notes
6. Optoma USA CinemaX P2 product page
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS API documentation