The ViewSonic vCast media streaming service, part of the ViewBoard smartboard devices running Android, has three distinct vulnerabilities exploitable without authentication. CVE-2026-82989 allows remote exfiltration of JPEG images of the screen via unauthenticated GET requests to /snapshot or /screen endpoints. CVE-2026-82988 permits remote triggering of unprivileged APK installation by supplying a malicious APK URL to an unauthenticated download endpoint. CVE-2026-82987 enables remote injection of arbitrary input into service endpoints through HTTP requests to exposed unauthenticated network services. These vulnerabilities can be chained by an attacker on the same network to execute arbitrary code and fully compromise the device, including persistent malicious app installation and unauthorized access to displayed content. The vendor has not responded to coordination requests, and no official patch or fix is currently available.

An unauthenticated remote attacker on the same network can exploit these vulnerabilities to exfiltrate screen content, install arbitrary applications without privileges, and execute arbitrary code on the device. This leads to full device compromise, unauthorized access to sensitive displayed information, persistent malware installation, and potential lateral movement within the connected network environment.

No official patch or fix is currently available as the vendor has not responded to coordination efforts. Interim mitigations include applying firmware updates when they become available, segmenting vCast devices onto isolated and secure networks with strict access controls separate from sensitive systems, and monitoring network activity for suspicious vCast-related connections.