CVE-2026-82987 - Vulnerability Details - OpenCVE

There exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to capture and exfiltrate the current screen content via GET requests to an unauthenticated /snapshot or /screen endpoint returning JPEGs

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Viewsonic	Vcast

No data.

No data.

References

Link	Providers
https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/
https://kb.cert.org/vuls/id/234131

History

Fri, 30 Oct 2026 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-200

Fri, 30 Oct 2026 16:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-306
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 22 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Viewsonic Viewsonic vcast
Vendors & Products		Viewsonic Viewsonic vcast

Thu, 22 Oct 2026 05:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-200

Wed, 21 Oct 2026 21:00:00 +0000

Type	Values Removed	Values Added
Description		There exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to capture and exfiltrate the current screen content via GET requests to an unauthenticated /snapshot or /screen endpoint returning JPEGs
Title		CVE-2026-82987
References		https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/ https://kb.cert.org/vuls/id/234131

MITRE

Status: PUBLISHED

Assigner: certcc

Published: 2026-10-21T20:48:10.861Z

Updated: 2026-10-30T15:46:25.624Z

Reserved: 2026-08-31T15:22:17.573Z

Link: CVE-2026-82987

Vulnrichment

Updated: 2026-10-30T15:44:50.695Z

NVD

Status : Deferred

Published: 2026-10-21T21:19:17.507

Modified: 2026-10-30T16:17:58.663

Link: CVE-2026-82987

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-82987", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-08-31T15:22:17.573Z", "datePublished": "2026-10-21T20:48:10.861Z", "dateUpdated": "2026-10-30T15:46:25.624Z"}, "containers": {"cna": {"title": "CVE-2026-82987", "descriptions": [{"lang": "en", "value": "There exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to capture and exfiltrate the current screen content via GET requests to an unauthenticated /snapshot or /screen endpoint returning JPEGs"}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Viewsonic", "product": "vCast", "versions": [{"status": "affected", "version": "v0.0.0", "lessThanOrEqual": "v3.2.715", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "references": [{"url": "https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/"}, {"url": "https://kb.cert.org/vuls/id/234131"}], "x_generator": {"engine": "VINCE 3.0.51", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-82987"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-10-21T20:48:10.861Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-306", "lang": "en", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T15:46:21.361443Z", "id": "CVE-2026-82987", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T15:46:25.624Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-82987", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T15:46:21.361443Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T15:44:50.695Z"}}], "cna": {"title": "CVE-2026-82987", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Viewsonic", "product": "vCast", "versions": [{"status": "affected", "version": "v0.0.0", "versionType": "custom", "lessThanOrEqual": "v3.2.715"}]}], "references": [{"url": "https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/"}, {"url": "https://kb.cert.org/vuls/id/234131"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.51", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-82987"}, "descriptions": [{"lang": "en", "value": "There exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to capture and exfiltrate the current screen content via GET requests to an unauthenticated /snapshot or /screen endpoint returning JPEGs"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-10-21T20:48:10.861Z"}}}, "cveMetadata": {"cveId": "CVE-2026-82987", "state": "PUBLISHED", "dateUpdated": "2026-10-30T15:46:25.624Z", "dateReserved": "2026-08-31T15:22:17.573Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-10-21T20:48:10.861Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}