CVE-2023-27823: Optoma 1080PSTX projector authentication bypass in admin console

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication and no user interaction, plus a 98.9th percentile EPSS score, makes this an urgent exposure despite the absence of KEV listing.

What it is

Optoma 1080PSTX firmware C02 contains an authentication bypass that lets an attacker reach the administration console without valid credentials. The flaw is classified as improper authentication (CWE-287) with an additional improper certificate validation weakness (CWE-295). Because the admin console controls the device, unauthenticated access is a serious exposure for any internet- or network-reachable projector.

Impact

An attacker gains full administrative control of the projector, which the CVSS vector rates as high confidentiality, integrity and availability impact. That can mean changing settings, reading device data, or disrupting operation.

Attack surface

The CVSS vector is AV:N/AC:L/PR:N/UI:N, so the flaw is reachable over the network with no authentication and no user interaction. Any host that can reach the device's management interface can attempt it.

Exploitation

The record is not listed in CISA KEV and no ransomware use is documented, but EPSS is 0.53593 (98.9th percentile), indicating a high modeled likelihood of exploitation. The only references are third-party advisories and a VDB entry, with no vendor advisory or public exploit tag supplied.

What to do

• Apply the latest Optoma firmware for the 1080PSTX; if no fixed release is confirmed, treat the device as unfixable and isolate it.
• Place the projector's management interface on a dedicated, segmented VLAN with no internet exposure.
• Restrict access to the admin console by source IP using firewall or ACL rules, allowing only trusted management hosts.
• Disable remote management or the web console entirely if the device is not required to be administered over the network.
• Monitor Optoma advisories and replace end-of-support units that will not receive a patch.

Detection

• Alert on successful logins or admin-console sessions from unexpected source IPs, especially where no credential exchange is observed.
• Monitor network flows to the projector's management ports for connections from outside the approved management subnet.
• Baseline and alert on configuration changes to the device (settings, users, network config) that occur outside change windows.
• Watch for repeated unauthenticated requests to admin endpoints in web or proxy logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.