Loading story…
CERT/CC disclosed three critical zero-day vulnerabilities in ViewSonic vCast software for Android-based ViewBoard interactive displays: CVE-2026-82987, CVE-2026-82988, and CVE-2026-82989. An attacker on the same network can exploit exposed unauthenticated services to capture the display screen, inject input commands, and remotely install an attacker-controlled Android APK without user interaction.
Chaining the flaws can enable surveillance of displayed content, arbitrary code execution, persistence, and effective full control of affected boards. A compromised ViewBoard could also serve as a foothold for lateral movement into connected education or enterprise networks. CERT/CC said it had been unable to reach ViewSonic and no fixes had been provided at disclosure; organizations should isolate affected displays, tightly restrict network access, and monitor them until patches are available.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
CERT/CC published Vulnerability Note VU#234131 covering CVE-2026-82987, CVE-2026-82988, and CVE-2026-82989 in ViewSonic vCast software for Android-based ViewBoard displays. The unauthenticated flaws enable input injection, screen capture, and installation of an attacker-supplied APK; they can be chained by a same-network attacker to potentially gain full device control and establish a foothold for lateral movement.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released the March 2026 *Android Security Bulletin*, issuing fixes for **129 vulnerabilities** across the Android ecosystem and shipping two patch levels (`2026-03-01` and `2026-03-05`) to help OEMs stage platform and hardware-specific updates. The most urgent issue is **CVE-2026-21385**, a **high-severity, actively exploited** zero-day in an open-source **Qualcomm display** component used in Android devices with affected Qualcomm/Snapdragon chipsets. Reporting indicates CVE-2026-21385 is a **memory-corruption** flaw caused by an **integer overflow/wraparound** condition that can lead to memory corruption during allocation/alignment in display drivers; successful exploitation could enable device compromise (e.g., arbitrary code execution and/or privilege escalation) and bypass security boundaries. Google and Qualcomm both acknowledged **limited, targeted exploitation in the wild**, and one account attributes discovery/confirmation of exploitation to Google’s **Threat Analysis Group (TAG)**; devices not updated to at least patch level `2026-03-05` remain exposed, making rapid patch deployment and user update compliance the primary risk-reduction actions.
Jun 29, 2026
CISA published ICS advisories warning of **critical “missing authentication for critical function”** weaknesses (CWE-306) that expose device management/control interfaces to unauthenticated access. **Synectix LAN 232 TRIO** (3-port serial-to-Ethernet adapter) is affected in **all versions** under **CVE-2026-1633** with **CVSS 3.1 10.0**, enabling unauthenticated attackers to **modify critical device settings** or **factory reset** the device. **Avation Light Engine Pro** is also affected in **all versions** under **CVE-2026-1341** with **CVSS 3.1 9.8**, allowing an attacker to **take full control** of the device due to an exposed configuration/control interface without authentication. Separate reporting highlighted a similar CISA alert for **KiloView Encoder Series** devices, tracked as **CVE-2026-1453** with **CVSS 9.8**, where missing authentication allows unauthenticated users to perform administrative actions such as **creating or deleting administrator accounts**, potentially granting full administrative control and enabling disruption or hijacking of broadcast/streaming workflows. The KiloView issue was described as affecting multiple Encoder Series models and specific firmware/hardware combinations (e.g., E1/E1-s/E2 with listed firmware versions), reinforcing the broader risk of internet- or enterprise-exposed device management planes lacking access control.
Jun 29, 2026
Zoom has patched four vulnerabilities, including a severe zero-click remote code execution flaw tracked as **CVE-2026-53413** that could let a meeting participant silently take over another participant’s device during calls involving screen sharing and annotation. Researchers reported that the bug stemmed from memory corruption in Zoom’s annotator protocol and required no victim interaction or visible warning, affecting Zoom clients across all supported platforms. The issue was disclosed alongside broader concerns that anyone on a call could exploit the screen-sharing workflow to compromise another device. The vulnerabilities, branded **"Zoomsday"** by security firm A Security, also included annotation-related denial-of-service and use-after-free flaws, while Zoom separately fixed **CVE-2026-53416**, a path traversal information disclosure bug in the Workplace VDI Client and VDI Plugins. Zoom released patches in the **7.1.5** series for Workplace, Rooms, and Meeting SDK products, and the disclosure also drew attention because researchers said they used a public AI tool and fewer than 20 prompts to help identify the bug.
Aug 21, 2026