EUVD-2026-92873
GHSA-wx6m-rmf7-wpp6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach vCast HTTP service on network
-
DeliverySend crafted request to unauthenticated endpoint
-
ExploitInject arbitrary input into endpoint
-
ExecutionTrigger injection flaw (CWE-74)
-
ImpactAchieve code execution per RCE chain
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | Exploitation requires the target ViewSonic ViewBoard to be running the vCast service with its network-exposed HTTP endpoints reachable by the attacker; the vulnerable endpoints are explicitly unauthenticated, so no credentials, tokens, or user interaction are needed. The practical limiting factor is network reachability of the vCast service (typically a classroom/meeting-room device that may sit on internal, segmented, or Wi-Fi networks rather than the public internet) and running an affected version (vCast v0.0.0 through v3.2.715). No non-default configuration appears necessary based on the description. |
| Impact | All available signals point to genuinely high real-world risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation with no user interaction and full C/I/A impact (9.8), which the description corroborates: HTTP requests to unauthenticated vCast endpoints. These signals are consistent rather than conflicting - unlike many 9.8 ratings where the description implies local or authenticated access, here the text explicitly states 'remote, unauthenticated attacker' and 'unauthenticated endpoints,' so the network/no-privilege metrics are well supported. The referenced blog post ('Vcast-Viewsonic-RCE-chain') indicates a public exploit-chain write-up exists, elevating practical risk beyond theory. EPSS probability was NOT provided in the input, and the CVE is NOT listed in CISA KEV, so there is no evidence of active in-the-wild exploitation at this time; the risk is driven by exploitability and public technical detail rather than observed campaigns. SSVC inputs (exploitation/automatable/technical-impact) were not supplied. Net: a credible high-priority patch target for any environment running affected vCast, but mass-exploitation telemetry (EPSS/KEV) is absent and should be monitored. |
| Exploit ScenarioDerived | A remote attacker on the same network as (or with routable access to) a ViewSonic ViewBoard reachable on its vCast service ports sends a crafted HTTP request to an unauthenticated endpoint, injecting arbitrary input that the service processes unsafely. Per the referenced write-up this is part of a documented RCE chain, so publicly available exploit code/technique detail exists. Because no authentication or user interaction is required and complexity is low, exploitation is straightforward once the device is reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated input injection in ViewSonic vCast, the wireless screen-casting service bundled with ViewBoard interactive displays, lets a remote attacker push crafted HTTP requests at exposed service endpoints and have that data accepted without validation, which public research chains onward to remote code execution. Affected builds span vCast v0.0.0 through v3.2.715 and are reachable over the network with no credentials and no user interaction (CVSS 9.8, AV:N/PR:N/UI:N), so every ViewBoard whose vCast endpoints are network-reachable is exposed; a public technical write-up describing the exploit chain exists (blog.l3afs.space), while no CISA KEV entry confirms active exploitation at time of analysis. All available signals point to genuinely high real-world risk, with the practical limiting factor being network reachability of the vCast service rather than any missing precondition.
RemediationAI
No vendor-released patch identified at time of analysis; the input data contains no fixed version, no vendor advisory with an upgrade target, and no patch reference beyond the research write-up and CERT/CC note, so treat vCast v3.2.715 and earlier as vulnerable until ViewSonic publishes a fixed build and then upgrade past the affected range. Until then, the highest-value compensating control is to remove network reachability: place ViewBoards on an isolated VLAN or management segment, block inbound TCP/HTTP access to the vCast service from user, guest, wireless, and internet-facing networks, and only permit casting traffic from explicitly trusted hosts - the trade-off is that display casting must be initiated from that trusted set or via an alternate path. Where casting is not needed continuously, disable or stop the vCast service on the device (side effect: users lose wireless casting and must fall back to HDMI or another presentation method), and where it must remain enabled, restrict access to the specific endpoints and monitor their logs for malformed or anomalous requests. Because public research chains this injection into full remote code execution, also verify there is no unauthorized persistence on any display that has been internet- or guest-network-exposed, and track https://kb.cert.org/vuls/id/234131 and https://nvd.nist.gov/vuln/detail/CVE-2026-82989 for the vendor fix announcement rather than relying on the CPE, which carries no version qualifier.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, i.e. injection) in the network-exposed HTTP service layer of vCast, ViewSonic's wireless presentation/casting component for ViewBoard interactive flat panels. Because the vulnerable endpoints perform no authentication check and sanitize no attacker-supplied input, data submitted in HTTP requests is passed through to service endpoints where it is interpreted rather than treated as inert data, giving an attacker control over downstream operations and, per public research, a path to code execution on the display. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity, unauthenticated attack that fully compromises confidentiality, integrity, and availability within the vCast/ViewBoard security scope. The CPE cpe:2.3:a:viewsonic:vcast:*:*:*:*:*:*:*:* indicates no version qualifier in the CPE dictionary, while the EUVD record pins the affected span to v0.0.0 through v3.2.715; the service is typically deployed on classroom, huddle-room, and meeting-room appliances that may live on internal, segmented, or wireless networks rather than the public internet.
Know when Vcast gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description confirms remote, unauthenticated HTTP injection with no user interaction, and the documented RCE chain supports full C/I/A impact; scope unchanged as impact stays within the device.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
3DescriptionCVE.org
There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints
Executive ViewAI
ViewSonic ViewBoard interactive displays running the bundled vCast service (builds v0.0.0 through v3.2.715) are exposed to a critical, unauthenticated remote code execution flaw for which no vendor patch exists. Any meeting room, classroom, or lobby display with network-reachable vCast endpoints can be taken over without credentials or user interaction, and publicly available exploit code exists, giving adversaries a practical path to establish a foothold inside the corporate network. Leadership should treat this as an immediate containment priority because the only practical barrier is whether the vCast service is reachable.
No vendor-released patch identified at time of analysis; interim mitigations include restricting network reachability of vCast endpoints with firewall/ACL rules, disabling vCast where not operationally required, isolating ViewBoards on a deny-by-default VLAN, and monitoring for anomalous HTTP requests to vCast services.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Exploit-DB