CVE-2026-82988

HighCVSS 7.5

Published: 06/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

There is an arbitrary file download vulnerability in the vCast APK delivery mechanism in ViewSonic ViewBoard. A remote, unauthenticated attacker can trigger unprivileged APK installation by serving a malicious APK URL through an unauthenticated download endpoint.

Risk Assessment

An attacker can install unauthorized applications on the ViewBoard device, potentially compromising system integrity or using the device for further attacks.

Recommendation

Secure the APK download endpoint, e.g., by requiring authentication and validating URLs, and restrict APK installation to trusted sources only.

Other vulnerabilities in ViewSonic ViewBoard

CVE-2026-82989Critical
There is an input injection vulnerability in vCast exposed network services in ViewSonic ViewBoard. A remote, unauthenticated attacker can inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints.

Original NVD description (English source)

There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoint

Vulnerability data from NVD (NIST) · CISA KEV · EPSS