ViewSonic vCast media streaming service allows unauthenticated screen exfiltration and device compromise

{
  "id": "38b0492664760e922ff9d54014ffdb56e0707148272bb0e4a7edb79a5f674bb3",
  "url": "https://kb.cert.org/vuls/id/234131",
  "method": "llm",
  "payload": {
    "kind": "advisory",
    "title": "ViewSonic vCast media streaming service allows unauthenticated screen exfiltration and device compromise",
    "summary": "ViewSonic vCast has three vulnerabilities that an unauthenticated attacker may chain over a shared network to access screen content, install applications, and compromise a device. The vendor could not be reached; firmware updates should be applied when available, and network isolation and monitoring are recommended.",
    "evidence": "ViewSonic vCast software, which is included in ViewBoard smartboard devices, contains multiple vulnerabilities that an attacker can chained to achieve full device compromise.",
    "products": [
      {
        "name": {
          "value": "ViewSonic vCast",
          "evidence": "ViewSonic vCast software, which is included in ViewBoard smartboard devices, contains multiple vulnerabilities"
        },
        "prerequisites": [
          {
            "value": "via a shared network",
            "evidence": "An unauthenticated attacker can chain these vulnerabilities via a shared network to deliver and execute arbitrary code on a vCast-based device without user interaction."
          }
        ],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-82987",
        "evidence": "CVE-2026-82987 vCast’s media streaming service allows a remote attacker to exfiltrate JPEG images of screen content via GET requests to an unauthenticated /snapshot or /screen API endpoint."
      },
      {
        "value": "CVE-2026-82988",
        "evidence": "CVE-2026-82988 vCast’s Android Package Kit (APK) delivery mechanism allows a remote attacker to trigger unprivileged file installation by providing a malicious APK URL through an unauthenticated download endpoint."
      },
      {
        "value": "CVE-2026-82989",
        "evidence": "CVE-2026-82989 vCast’s network services allow a remote attacker to inject arbitrary input into service endpoints via HTTP requests to exposed unauthenticated endpoints"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-cert-cc-vulnerability-notes",
  "document_id": 23373,
  "published_at": "2026-09-24T19:27:42.401+00:00"
}