ViewSonic vCast CVE-2026-82988

Requires network access to the vCast APK delivery/download endpoint, which is exposed WITHOUT authentication (PR:N) and WITHOUT any user interaction (UI:N); the attacker must be able to supply or redirect the endpoint to a malicious APK URL that the device will fetch and install. Applies to ViewSonic vCast versions v0.0.0 through v3.2.715 inclusive. LIMITING FACTORS: the attacker must be able to reach the device's download endpoint (typically same-network or otherwise routable to the ViewBoard), and the resulting installation is UNPRIVILEGED - the planted APK runs as a normal app, not system/root, so by itself it is a foothold rather than full device compromise (the public writeup chains it with further steps to reach RCE).

The provided CVSS 3.1 base score is 7.5 (HIGH) with vector AV:N/AC:L/PR:N/UI:N - network-reachable, low complexity, no privileges and no user interaction, meaning the raw exploitability is high and the flaw is trivially repeatable. CISA SSVC in the input reinforces this operationally: Automatable=yes (the unauthenticated download endpoint can be scripted en masse), but Exploitation=none (no observed exploitation) and Technical Impact=partial. There is no CISA KEV listing and no EPSS score was provided, so I cannot quantify real-world exploitation probability; the SSVC 'Exploitation: none' plus absence of KEV suggests no confirmed active exploitation at time of analysis, despite the easy exploitability. A detailed technical exploit-chain writeup is publicly hosted (l3afs blog, 'Vcast-Viewsonic-RCE-chain') and the issue is tracked by CERT/CC (VU#234131), which materially lowers the barrier to weaponization even though SSVC still rates exploitation as none. One conflict to flag: the official vector sets C:H/I:N/A:N, but the description ('arbitrary file download ... triggers unprivileged APK installation') describes an integrity/code-delivery problem rather than a confidentiality breach, and CWE-287 (auth bypass) also does not map cleanly to a confidentiality-only impact - verify the impact metrics with the vendor/CERT. Net: this is a genuine priority for organizations running ViewSonic vCast (it is one link in a documented RCE chain), but not a drop-everything internet-wide emergency given no KEV, SSVC exploitation=none, unprivileged install scope, and missing EPSS.

An attacker with network reachability to a ViewSonic ViewBoard running vCast (v3.2.715 or earlier) sends a request to the unauthenticated vCast APK download/delivery endpoint, pointing it at an attacker-controlled URL hosting a malicious APK. Because no authentication or user interaction is required (PR:N/UI:N), the device fetches and installs the attacker's unprivileged APK automatically, giving the attacker a foothold application on the display - a step the published l3afs writeup chains toward full RCE. A public technical exploit-chain writeup exists, lowering the effort to reproduce this.