Vcast
Monthly
Remote unauthenticated attackers can make ViewSonic vCast fetch and install an attacker-supplied APK by abusing the vCast APK delivery mechanism's unauthenticated download endpoint to point the device at a malicious APK URL. Affected versions are vCast v0.0.0 through v3.2.715 inclusive on ViewSonic ViewBoard devices; the endpoint is network-reachable with no privileges and no user interaction, but the resulting installation is unprivileged, so the planted app runs as a normal application rather than with system/root rights. The supplied CVSS 3.1 base vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5), while our independent assessment treats the practical impact as C:N/I:L/A:N because the outcome is unprivileged app installation; no public exploit identified at time of analysis and no CISA KEV active exploitation is indicated.
Unauthenticated input injection in ViewSonic vCast, the wireless screen-casting service bundled with ViewBoard interactive displays, lets a remote attacker push crafted HTTP requests at exposed service endpoints and have that data accepted without validation, which public research chains onward to remote code execution. Affected builds span vCast v0.0.0 through v3.2.715 and are reachable over the network with no credentials and no user interaction (CVSS 9.8, AV:N/PR:N/UI:N), so every ViewBoard whose vCast endpoints are network-reachable is exposed; a public technical write-up describing the exploit chain exists (blog.l3afs.space), while no CISA KEV entry confirms active exploitation at time of analysis. All available signals point to genuinely high real-world risk, with the practical limiting factor being network reachability of the vCast service rather than any missing precondition.
Remote unauthenticated attackers can make ViewSonic vCast fetch and install an attacker-supplied APK by abusing the vCast APK delivery mechanism's unauthenticated download endpoint to point the device at a malicious APK URL. Affected versions are vCast v0.0.0 through v3.2.715 inclusive on ViewSonic ViewBoard devices; the endpoint is network-reachable with no privileges and no user interaction, but the resulting installation is unprivileged, so the planted app runs as a normal application rather than with system/root rights. The supplied CVSS 3.1 base vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5), while our independent assessment treats the practical impact as C:N/I:L/A:N because the outcome is unprivileged app installation; no public exploit identified at time of analysis and no CISA KEV active exploitation is indicated.
Unauthenticated input injection in ViewSonic vCast, the wireless screen-casting service bundled with ViewBoard interactive displays, lets a remote attacker push crafted HTTP requests at exposed service endpoints and have that data accepted without validation, which public research chains onward to remote code execution. Affected builds span vCast v0.0.0 through v3.2.715 and are reachable over the network with no credentials and no user interaction (CVSS 9.8, AV:N/PR:N/UI:N), so every ViewBoard whose vCast endpoints are network-reachable is exposed; a public technical write-up describing the exploit chain exists (blog.l3afs.space), while no CISA KEV entry confirms active exploitation at time of analysis. All available signals point to genuinely high real-world risk, with the practical limiting factor being network reachability of the vCast service rather than any missing precondition.