VU#234131: ViewSonic vCast media streaming service allows unauthenticated screen exfiltration and device compromise
Unauthenticated ViewSonic vCast flaws can leak screens and fully compromise ViewBoard devices.
CERT/CC published VU#234131 on three unauthenticated flaws in ViewSonic vCast, the wireless suite shipped on Android-based ViewBoard smartboards used in enterprises and schools. CVE-2026-82989 exposes /snapshot and /screen endpoints that return JPEG images of the display. CVE-2026-82988 accepts a remote APK URL on an unauthenticated download endpoint, and CVE-2026-82987 allows arbitrary input injection into exposed service endpoints. Chained over a shared network, the issues can install and run arbitrary apps without user interaction; ViewSonic could not be reached, so CERT recommends segmentation until firmware updates are available.
- Three unauthenticated vCast flaws can be chained for full device compromise.
- CVE-2026-82989 leaks JPEG screen snapshots through open API endpoints.
- CVE-2026-82988 can install an attacker-supplied APK without user interaction.
- ViewSonic was unreachable; isolate devices until firmware updates exist.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82987 | There exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to capture and… | 7.5 | — | ||
CVE-2026-82989+1 related CVE | Unauthenticated input injection in ViewSonic ViewBoard vCast | 9.8 group max | — |
From the original article
1 min read at kb.cert.orgOverview ViewSonic vCast software, which is included in ViewBoard smartboard devices, contains multiple vulnerabilities that an attacker can chained to achieve full device compromise. Description ViewSonic ViewBoards are widely used smart display devices (smartboard), typically deoloyed in enterprise and educational environments.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.