CVE-2026-82988
Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: CERT/CC

Description
There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoint

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-19
AI Q&A
2026-10-06
EPSS Evaluated
2026-10-18
NVD
CVE-2026-82988
EUVD
EUVD-2026-92874

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Viewsonic vCast v0.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82988 is a flaw in ViewSonic's vCast media streaming service that allows a remote attacker to trigger unprivileged file installation by providing a malicious APK URL through an unauthenticated download endpoint. This vulnerability can be combined with other flaws in the vCast suite to compromise devices fully.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthenticated connections to TCP port 8121 on ViewSonic ViewBoard devices. Check for unusual APK downloads or installations initiated from external sources. Inspect logs for commands sent to the open control socket on port 8121.

Impact Analysis

This vulnerability could allow attackers to install arbitrary applications on your ViewSonic ViewBoard device without authentication. This may lead to unauthorized access to displayed content, persistent malicious software installation, or full system takeover, especially if chained with other vulnerabilities.

Compliance Impact

This vulnerability could lead to unauthorized access to displayed content and persistent installation of arbitrary applications, potentially violating data protection requirements under GDPR and HIPAA by exposing sensitive information or allowing unauthorized data exfiltration.

Mitigation Strategies

Isolate vCast devices on secure, segmented networks to prevent unauthorized access. Disable or block TCP port 8121 if possible. Monitor for suspicious activity and avoid exposing these devices to untrusted networks until firmware updates are available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82988. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart