{"id":"CVE-2026-82989","published":"2026-10-06T00:16:37.097","lastModified":"2026-10-06T15:03:59.427","description":"There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-74","CWE-147"],"vendors":[],"products":[],"references":[{"url":"https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/","tags":[]},{"url":"https://kb.cert.org/vuls/id/234131","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw is an input injection vulnerability in ViewSonic ViewBoard's vCast service, allowing remote, unauthenticated attackers to inject arbitrary data via HTTP requests, potentially leading to remote code execution or data compromise.","exploitability":"Exploitation is relatively straightforward given the unauthenticated nature and the ability to inject arbitrary input via network-based HTTP requests.","blast_radius":"If exploited, this could lead to significant data loss, unauthorized code execution, or complete system compromise, affecting all users of the affected service endpoints.","remediation":"Disable the vCast service or restrict access to the affected endpoints until a patch is available.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","input-injection","unauthenticated"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:42:56.838Z"}}