CVE-2026-82988

CVE-2026-82988 is an arbitrary file download flaw in the vCast APK delivery mechanism on ViewSonic ViewBoard devices. A remote, unauthenticated attacker can point an unauthenticated download endpoint at a malicious APK URL so the device fetches and installs that package without credentials, at unprivileged installation rights. That lets an attacker place their own software on an affected display. The advisory does not name affected versions. No public proof of concept is known, the issue is not in CISA KEV, and exploitation in the wild is not known; related reporting (VU#234131) also describes other unauthenticated vCast issues such as screen exfiltration and device compromise.

What to do: Keep ViewSonic ViewBoard devices that use vCast off untrusted networks and block remote access to the vCast download or APK-delivery service until ViewSonic publishes a fix. Apply the vendor update as soon as a patched build is identified, and check devices for unexpected installed packages. Follow CERT VU#234131 and the vendor advisory for version-specific remediation; no fixed version is named in this CVE record.