CVE-2026-82987 Details
Description
There exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to capture and exfiltrate the current screen content via GET requests to an unauthenticated /snapshot or /screen endpoint returning JPEGs
A vulnerability exists in the vCast media streaming service on ViewSonic ViewBoard devices, allowing remote, unauthenticated attackers to capture and exfiltrate screen content. This is achieved by sending GET requests to the unauthenticated '/snapshot' or '/screen' endpoints, which return JPEG images of the current screen. The vulnerability arises from missing authorization on the endpoint, enabling unauthorized access to visual data being presented on the board.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/ | [email protected] | BundleExploitTechnical Analysis |
| https://kb.cert.org/vuls/id/234131 | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| ViewSonic vCast | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |