ViewSonic vCast Vulnerabilities Let Attackers Gain Full Device Control Without Authentication
CERT/CC warns unauthenticated ViewSonic vCast flaws can capture screens, install apps, and fully control ViewBoards.
The CERT Coordination Center disclosed three vulnerabilities in ViewSonic vCast, tracked as VU#234131, on Android ViewBoard smart displays used in classrooms and enterprises. CVE-2026-82989 lets unauthenticated attackers retrieve JPEG screenshots via the /snapshot and /screen endpoints. CVE-2026-82988 and CVE-2026-82987 allow malicious APK delivery and service-input injection, which CERT/CC says can be chained for unauthenticated code execution. ViewSonic's status is listed as unknown, and CERT/CC said it could not reach the vendor.
- Unauthenticated vCast flaws can fully compromise ViewBoard displays.
- CVE-2026-82989 leaks JPEG screenshots through open HTTP APIs.
- Two more flaws enable malicious APK install and input injection.
- CERT/CC could not reach ViewSonic; isolate devices until patched.
- Vendors
- ViewSonic
- Organizations
- CERT Coordination Center
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82987 | There exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to capture and… | 7.5 | — | ||
CVE-2026-82989+1 related CVE | Unauthenticated input injection in ViewSonic ViewBoard vCast | 9.8 group max | — |
From the original article
2 min read at gbhackers.com
The CERT Coordination Center (CERT/CC) has revealed a chain of three vulnerabilities in ViewSonic’s vCast software that could enable unauthenticated attackers on a shared network to steal displayed screen content, install malicious Android applications, and ultimately gain full control of affected ViewBoard smart displays. These vulnerabilities, tracked as VU#234131, affect vCast, the wireless casting and […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.