Is CVE-2026-30495 actively exploited?

No active exploitation of CVE-2026-30495 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-30495 be exploited remotely?

Partially. CVE-2026-30495 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2026-30495?

CVE-2026-30495 has a CVSS score of 8.8 (HIGH).

HOME VULNERABILITIESCVE-2026-30495

HIGH

CVE-2026-30495

Published: May 7, 2026· Updated: May 8, 2026

8.8

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:6.2th

Official Description

The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes Android Debug Bridge (ADB) on TCP port 5555 over the network without requiring authentication. The device is configured with ro.adb.secure=0, which disables RSA key verification. Additionally, a functional su binary exists at /system/xbin/su that grants root privileges without authentication. An attacker on the same network can connect to the device via ADB, obtain a shell, and escalate to root privileges, gaining complete control of the device. This allows extraction of stored WiFi credentials, installation of persistent malware, and access to all device data.

NVD Source

Technical Analysis

CVE-2026-30495 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.