Unauthenticated Network ADB Access on Optoma Projectors

The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes Android Debug Bridge (ADB) on TCP port 5555 over the network without requiring authentication. The device is configured with ro.adb.secure=0, which disables RSA key verification. Additionally, a functional su binary exists at /system/xbin/su that grants root privileges without authentication. An attacker on the same network can connect to the device via ADB, obtain a shell, and escalate to root privileges, gaining complete control of the device. This allows extraction of stored WiFi credentials, installation of persistent malware, and access to all device data.

Casky was already ahead

This CVE exploits attack patterns that Casky's 261matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-30495 exposes a critical authentication bypass vulnerability in Optoma CinemaX P2 projectors where Android Debug Bridge (ADB) is accessible over the network without any authentication mechanism. The vulnerability combines multiple misconfigurations: ADB is enabled on TCP port 5555, RSA key verification is disabled (ro.adb.secure=0), and an unauthenticated su binary provides direct root access. Any attacker on the same network segment can exploit this to gain complete control of the device. This affects organizations using these projectors in corporate environments, educational institutions, and venues where network isolation may be limited, potentially enabling lateral movement, data exfiltration, or device manipulation for supply chain attacks.

Casky's 261 mapped security skills leverage Claude AI's extended reasoning to identify the attack chain spanning MITRE ATT&CK's Initial Access (TA0004) and Privilege Escalation (TA0006) tactics. Practitioners would observe detection patterns including: network reconnaissance of port 5555 for ADB services, unauthenticated ADB connection attempts, execution of shell commands without credential submission, and rapid privilege escalation to root via the su binary. The platform's skill correlation would highlight the progression from network access → shell execution → root elevation, enabling security teams to recognize this specific attack pattern in their network telemetry, endpoint logs, and threat intel feeds before adversaries establish persistent footholds on connected devices.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

261 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-30495.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-30495

Casky has 261 skills that investigate the attack patterns behind CVE-2026-30495. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn