# CVE-2026-82989: ViewSonic ViewBoard vCast input injection vulnerability

Source: https://junglewise.ai/threats/cve-2026-82989-there-is-an-input-injection-in-vcast-exposed-network-services-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-82989 · Severity: info · Published 2026-10-06

ViewSonic ViewBoard smartboards used in enterprises and education include vCast wireless collaboration software that accepts unauthenticated network commands. An attacker can send arbitrary input to exposed service endpoints without authentication, allowing keystroke injection and control of the display. This can be chained with other flaws to install malicious applications and fully compromise the device.

Technologies: [ViewSonic ViewBoard](https://junglewise.ai/threats/technologies/viewboard). Vendors: [ViewSonic](https://junglewise.ai/threats/vendors/viewsonic).

## Quick answers

**Is CVE-2026-82989 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82989 being exploited in the wild.

**How severe is CVE-2026-82989?** Informational severity, published 6 October 2026.

**Which products and versions are affected?** ViewSonic ViewBoard unknown.

**Is there a fix for CVE-2026-82989?** No fixed version is recorded yet. Segment vCast devices onto an isolated, secure network separate from systems containing sensitive data, and monitor network activity for suspicious vCast connections. Apply firmware updates when available.</anigation>
</invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82989 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-82989?** Check whether you run ViewSonic ViewBoard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Segment vCast devices onto an isolated, secure network separate from systems containing sensitive data, and monitor network activity for suspicious vCast connections. Apply firmware updates when available.</anigation>
</invoke>

## Technical details

CVE-2026-82989 is an input injection vulnerability in vCast's TCP port 8121 control socket, which accepts plaintext ASCII commands without authentication or cryptographic verification. An unauthenticated remote attacker on the network can send KEYEVENT commands to inject arbitrary Android keycodes, enabling keystroke injection and navigation control. This endpoint is exposed by default on 0.0.0.0 and can be chained with CVE-2026-82987 (screen capture) and CVE-2026-82988 (arbitrary APK download) to achieve full device compromise.

## Affected products

- ViewSonic ViewBoard unknown

## Timeline

- 2026-09-24: disclosed
- 2026-10-06: advisory

## References

- [https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/](https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/)
- [https://kb.cert.org/vuls/id/234131](https://kb.cert.org/vuls/id/234131)

## Related threats

- [ViewSonic ViewBoard vCast unauthenticated screen capture](https://junglewise.ai/threats/cve-2026-82987-there-exists-a-screen-capture-endpoint-in-vcast-media-streaming)
- [ViewSonic ViewBoard arbitrary APK download via unauthenticated endpoint](https://junglewise.ai/threats/cve-2026-82988-there-exists-an-arbitrary-file-download-in-vcast-apk-delivery)