Three zero-day vulnerabilities in ViewSonic’s vCast software can be chained by attackers on the same network to remotely view smartboard screens, install malicious Android applications, and potentially take complete control of affected devices.
CERT/CC disclosed the flaws on September 24 after ViewSonic could not be reached for coordinated vulnerability disclosure, leaving the vendor’s remediation status unknown.
The vulnerabilities were reported by security researcher Adam Mohammed Zenker, who published technical details of his findings on September 17.
ViewSonic ViewBoards are Android-based interactive displays commonly deployed in classrooms, meeting rooms, and enterprise environments. The devices use ViewSonic’s proprietary vCast software to let computers and mobile devices wirelessly connect to and share content with a board.
Zenker found that the systems expose several network services without adequate authentication, including an HTTP service and a plaintext control socket. Devices also continuously advertise information over UDP port 48689, potentially exposing their IP address, device name, and room information to anyone listening on the local network.
According to CERT/CC, CVE-2026-82989 allows unauthenticated attackers to retrieve JPEG images containing the current screen contents through exposed /snapshot or /screen API endpoints. Zenker observed a similar /preview endpoint on TCP port 8000 that could repeatedly return screen captures, effectively allowing an attacker to monitor presentations in real time.
CVE-2026-82988 affects vCast’s APK delivery mechanism. An attacker can provide a URL pointing to an arbitrary Android application, causing the ViewBoard to download the APK and open the package installation process.
The third vulnerability, CVE-2026-82987, allows unauthenticated users to send input to exposed service endpoints. Zenker found that TCP port 8121 accepts plaintext Android KeyEvent commands, allowing remote keyboard-style input.
These weaknesses can be chained. An attacker could instruct a ViewBoard to download a malicious APK and then inject navigation and confirmation key presses to approve installation without physical user interaction.
CERT/CC warns that successful exploitation could result in persistent malicious applications, unauthorized access to displayed information, arbitrary code execution, and full compromise of the ViewBoard. A breached device could also provide an attacker with a foothold for lateral movement into other systems on the network.
Zenker additionally disclosed an apparently unpatched denial-of-service flaw affecting the vCastSender application, caused by a null-pointer dereference. The issue had not received a CVE identifier when he published his research.
With no vendor fix confirmed, administrators should isolate ViewBoards and other vCast devices on restricted network segments, block unnecessary access to exposed services, monitor for suspicious connections, and install ViewSonic firmware updates as soon as patches become available.
Leave a Reply