CVE-2026-82988 - Vulnerability Details - OpenCVE

There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoint

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Viewsonic	Vcast

No data.

No data.

References

Link	Providers
https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/
https://kb.cert.org/vuls/id/234131

History

Tue, 06 Oct 2026 21:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Viewsonic Viewsonic vcast
Vendors & Products		Viewsonic Viewsonic vcast

Tue, 06 Oct 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-287 CWE-502
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 06 Oct 2026 00:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-284 CWE-434

Mon, 05 Oct 2026 23:30:00 +0000

Type	Values Removed	Values Added
Description		There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoint
Title		CVE-2026-82988
References		https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/ https://kb.cert.org/vuls/id/234131

MITRE

Status: PUBLISHED

Assigner: certcc

Published: 2026-10-05T23:14:28.183Z

Updated: 2026-10-06T13:13:22.219Z

Reserved: 2026-08-31T15:22:24.690Z

Link: CVE-2026-82988

Vulnrichment

Updated: 2026-10-06T13:13:12.960Z

NVD

Status : Deferred

Published: 2026-10-06T00:16:36.973

Modified: 2026-10-06T15:03:59.427

Link: CVE-2026-82988

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-82988", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-08-31T15:22:24.690Z", "datePublished": "2026-10-05T23:14:28.183Z", "dateUpdated": "2026-10-06T13:13:22.219Z"}, "containers": {"cna": {"title": "CVE-2026-82988", "descriptions": [{"lang": "en", "value": "There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoint"}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Viewsonic", "product": "vCast", "versions": [{"status": "affected", "version": "v0.0.0", "lessThanOrEqual": "v3.2.715", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-287 Improper Authentication"}]}, {"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}, {"descriptions": [{"lang": "en", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "references": [{"url": "https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/"}, {"url": "https://kb.cert.org/vuls/id/234131"}], "x_generator": {"engine": "VINCE 3.0.49", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-82988"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-10-05T23:14:28.183Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-287", "lang": "en", "description": "CWE-287 Improper Authentication"}, {"type": "CWE", "cweId": "CWE-434", "lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}, {"type": "CWE", "cweId": "CWE-502", "lang": "en", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-06T13:12:32.814466Z", "id": "CVE-2026-82988", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T13:13:22.219Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-82988", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-06T13:12:32.814466Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}, {"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}, {"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T13:13:12.960Z"}}], "cna": {"title": "CVE-2026-82988", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Viewsonic", "product": "vCast", "versions": [{"status": "affected", "version": "v0.0.0", "versionType": "custom", "lessThanOrEqual": "v3.2.715"}]}], "references": [{"url": "https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/"}, {"url": "https://kb.cert.org/vuls/id/234131"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.49", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-82988"}, "descriptions": [{"lang": "en", "value": "There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoint"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-287 Improper Authentication"}]}, {"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}, {"descriptions": [{"lang": "en", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-10-05T23:14:28.183Z"}}}, "cveMetadata": {"cveId": "CVE-2026-82988", "state": "PUBLISHED", "dateUpdated": "2026-10-06T13:13:22.219Z", "dateReserved": "2026-08-31T15:22:24.690Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-10-05T23:14:28.183Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}