CVE-2026-82989
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
There is an input injection vulnerability in vCast exposed network services in ViewSonic ViewBoard. A remote, unauthenticated attacker can inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints.
Risk Assessment
An attacker can manipulate network service behavior, potentially leading to unauthorized changes or disruption of the ViewBoard device, without any credentials.
Recommendation
Restrict access to unauthenticated service endpoints, e.g., via firewall or network segmentation, and enforce authentication for all sensitive endpoints.
Other vulnerabilities in ViewSonic ViewBoard
See all- CVE-2026-82987High
A screen capture endpoint in the vCast media streaming service in ViewSonic ViewBoard allows a remote, unauthenticated attacker to capture and exfiltrate the current screen content. GET requests to unauthenticated /snapshot or /screen endpoints return JPEGs.
- CVE-2026-82988High
There is an arbitrary file download vulnerability in the vCast APK delivery mechanism in ViewSonic ViewBoard. A remote, unauthenticated attacker can trigger unprivileged APK installation by serving a malicious APK URL through an unauthenticated download endpoint.
Original NVD description (English source)
There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints
Vulnerability data from NVD (NIST) · CISA KEV · EPSS