# CVE-2026-82987: ViewSonic ViewBoard vCast unauthenticated screen capture

Source: https://junglewise.ai/threats/cve-2026-82987-there-exists-a-screen-capture-endpoint-in-vcast-media-streaming  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-82987 · Severity: info · Published 2026-10-21

ViewSonic ViewBoard smartboards use vCast, a wireless presentation platform widely deployed in offices and schools. A remote attacker can directly capture live screenshots from any board on the network without any authentication, exposing sensitive business or educational content currently displayed on the screen.

Technologies: [ViewSonic ViewBoard](https://junglewise.ai/threats/technologies/viewboard). Vendors: [ViewSonic](https://junglewise.ai/threats/vendors/viewsonic).

## Quick answers

**Is CVE-2026-82987 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82987 being exploited in the wild.

**How severe is CVE-2026-82987?** Informational severity, published 21 October 2026.

**Which products and versions are affected?** ViewSonic ViewBoard unknown.

**Is there a fix for CVE-2026-82987?** No fixed version is recorded yet. Segment vCast devices onto an isolated, secure network separate from systems containing sensitive data, and monitor network activity for suspicious vCast connections. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82987 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-82987?** Check whether you run ViewSonic ViewBoard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Segment vCast devices onto an isolated, secure network separate from systems containing sensitive data, and monitor network activity for suspicious vCast connections.

## Technical details

The vCast HTTP service on port 8000 exposes an unauthenticated /preview endpoint that returns raw JPEG frames of the current screen display with no authentication checks or state verification required. An attacker with network access can loop requests to this endpoint to obtain a continuous live video stream of screen content. The vulnerability exists because the endpoint lacks any cookie, token, or pairing validation mechanism.

## Affected products

- ViewSonic ViewBoard unknown

## Timeline

- 2026-09-24: disclosed
- 2026-10-21: advisory

## References

- [https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/](https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/)
- [https://kb.cert.org/vuls/id/234131](https://kb.cert.org/vuls/id/234131)

## Related threats

- [ViewSonic ViewBoard vCast input injection vulnerability](https://junglewise.ai/threats/cve-2026-82989-there-is-an-input-injection-in-vcast-exposed-network-services-in)
- [ViewSonic ViewBoard arbitrary APK download via unauthenticated endpoint](https://junglewise.ai/threats/cve-2026-82988-there-exists-an-arbitrary-file-download-in-vcast-apk-delivery)