Live › vulnerability › CVE-2026-82987
Go to dashboardThe vCast media streaming service on ViewSonic ViewBoard interactive displays exposes a /snapshot or /screen endpoint that returns JPEG captures without authentication. A remote attacker can fetch the current screen contents and exfiltrate whatever is on the display.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organizations running ViewSonic ViewBoard interactive displays with the vCast media streaming service reachable from a network an attacker can reach. Displays kept off untrusted networks and not exposed through port forwarding or public addressing are much less exposed. The sources do not state which firmware versions are affected.
No product ranges from the sources yet.
/snapshot or /screen and confirming a JPEG comes back.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
There exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to capture and exfiltrate the current screen content via GET requests to an unauthenticated /snapshot or /screen endpoint returning JPEGs
This page as .md · .json · in your agent: get_signal("CVE-2026-82987")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.