Reported by 3 outlets
ViewSonic vCast Vulnerabilities Let Attackers Gain Full Device Control Without Authentication
Why this score
- Breadth
- 1.50 / 2.0 · 3 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.03 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
ViewSonic vCast wireless sharing software bundled with ViewBoard smart displays carries three critical unauthenticated vulnerabilities tracked as CVE-2026-82987, CVE-2026-82988, and CVE-2026-82989. CERT/CC assigned VU#234131 and disclosed the chain on September 24, 2026. Unauthenticated attackers on the same network can retrieve screen images via exposed /snapshot or /screen endpoints, install malicious Android applications, and gain full device control through input injection. The flaws affect enterprise and educational deployments of Android-based interactive displays.
No active exploitation has been confirmed in the event content, but unauthenticated network-accessible endpoints on smartboards create high-impact exposure for presentations, credentials, and confidential documents. Defenders should isolate ViewBoard devices, restrict vCast endpoint access, and apply vendor patches when available.
Timeline
-
original reporting
ViewSonic vCast Vulnerabilities Let Attackers Gain Full Device Control Without Authentication
gbhackers.com · 15d ago · September 28th, 2026
The CERT Coordination Center (CERT/CC) has revealed a chain of three vulnerabilities in ViewSonic’s vCast software that could enable unauthenticated attackers on a shared network to steal displayed screen content, install malicious Android applications, and ultimately gain full control of affected ViewBoard smart displays. These vulnerabilities, tracked as VU#234131, affect vCast, the wireless casting and […] The post ViewSonic vCast Vulnerabilities Let Attackers Gain Full Device Control Without Authentication appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from radar.offseq.com
CVE-2026-82989 (CRITICAL): ViewSonic vCast (ViewBoard) has unauth. flaws — screen exfiltration, APK install, input injection — allowing full
radar.offseq.com · 19d ago · September 25th, 2026
CVE-2026-82989 (CRITICAL): ViewSonic vCast (ViewBoard) has unauth. flaws — screen exfiltration, APK install, input injection — allowing full
via Mastodon https://radar.offseq.com/threat/vu234131-viewsonic-vcast-media-streaming-service-allows-unauthenticated-screen-exfiltration-and-device-6766923a5b9bed0d
-
update from cyberpress.org
ViewSonic vCast Flaws Let Unauthenticated Attackers Gain Full Control of Smartboards
cyberpress.org · 15d ago · September 28th, 2026
CERT Coordination Center (CERT/CC) disclosed the issues in Vulnerability on September 24, warning that the flaws affect vCast-enabled ViewBoards deployed across enterprise and educational environments. ViewBoard devices are Android-based interactive displays commonly used in classrooms, meeting rooms, training facilities, and corporate collaboration spaces. ViewSonic vCast Flaws Their vCast software allows wireless connectivity and screen sharing between the display and devices running a compatible client application. However, researchers found that several network-accessible vCast endpoints do not require authentication, creating a path for nearby or internal attackers to compromise a smartboard without user interaction. An attacker can send GET requests to exposed /snapshot or /screen API endpoints and retrieve JPEG images of the content currently displayed on the ViewBoard. This could expose presentations, credentials, confidential documents, video-conference details, student information, business dashboards, and othe