The Optoma CinemaX P2 projector runs Android 8.0.0 and exposes ADB on TCP port 5555 without authentication. The device has ro.adb.secure set to 0, disabling RSA key verification, and a su binary in /system/xbin/su that grants root privileges with no authentication. An attacker on the same local network can connect via ADB, obtain a shell, and immediately elevate to root. This provides complete control of the device, allowing the attacker to steal stored Wi‑Fi credentials, install persistent malware, and access all data stored on the projector. This weakness corresponds to CWE‑284 (Improper Access Control).

Affected devices are Optoma CinemaX P2 projectors with firmware TVOS‑04.24.010.04.01 running Android 8.0.0. No other vendors or versions are listed in the CNA data, so only this specific configuration is known to be vulnerable.

The CVSS or EPSS scores are not available, but the vulnerability is trivial to exploit because it requires only local network access and no authentication. The device’s network exposure of ADB makes the attack vector obvious, and the presence of a root binary eliminates privilege checks. Although the vulnerability is not currently listed in the CISA KEV catalog, its impact is high due to the ease of exploitation and full root access.