ViewSonic vCast Software Zero-Day Flaws Enable Device Takeover

• •Three zero-day vulnerabilities in ViewSonic's vCast software disclosed.
• •Attackers can remotely view screens and install malicious apps on ViewBoards.
• •No vendor fix available; isolation and monitoring recommended.

Three zero-day vulnerabilities in ViewSonic's vCast software were disclosed by CERT/CC on September 24, 2026. These flaws, affecting ViewSonic ViewBoards, allow attackers on the same network to remotely view screens, install malicious Android applications, and potentially take full control of the devices. The vulnerabilities are identified as CVE-2026-82989, CVE-2026-82988, and CVE-2026-82987. Attackers can exploit these flaws by accessing exposed API endpoints, tricking devices into downloading malicious apps, and sending input commands without authentication. With no confirmed vendor fix, administrators are advised to isolate affected devices and monitor for suspicious activity. The vulnerabilities pose a significant risk of unauthorized access and lateral movement within networks.