CVE-2026-82989

CVE-2026-82989 is an input-injection flaw in the vCast network services exposed by ViewSonic ViewBoard displays. A remote, unauthenticated attacker can send network HTTP requests to unauthenticated service endpoints and inject arbitrary input into those endpoints. Related reporting under VU#234131 describes the broader vCast issue set as allowing unauthenticated screen exfiltration and full device compromise, but this CVE record itself only documents unauthenticated input injection and has not been CVSS-scored. ViewSonic ViewBoard devices that expose vCast are affected; no version range is stated in the data. No public proof-of-concept is known and the flaw is not in CISA KEV, so exploitation is not known to be in the wild.

What to do: Keep ViewBoard vCast services off untrusted and internet-facing networks, and allow access only from trusted management or casting clients. Check ViewSonic and CERT advisory VU#234131 for a fixed build and apply it when published; until then disable vCast if casting is not required and review device logs for unexpected unauthenticated HTTP requests to vCast endpoints.