The Optoma CinemaX P2 projector implements a public HTTP API listening on TCP port 2345 that allows complete remote control without any credentials. The API offers 74 endpoints for reading and writing configuration data, including critical system settings such as volume, mute, brightness, power state, network protocol enablement, and display modes. Because no authentication is enforced, any host on the same network can issue commands to alter projector behavior or expose additional services, constituting a significant loss of control over the device.

Optoma CinemaX P2 projector running firmware TVOS-04.24.010.04.01 on Android 8.0.0. No other manufacturers or firmware versions are listed as affected in the available data.

The vulnerability is exploitable by any attacker who can reach the projector over the local network. The lack of authentication implies a low barrier to exploitation and a high likelihood of successful attacks in environments where the projector is not isolated from other devices. While EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, the ability to issue commands to alter projector behavior represents a significant risk to the device’s operational integrity. The CVSS score is not specified, but the impact warrants immediate review of network segmentation and device hardening practices.