Viewsonic’s vCast media streaming service exposes an unauthenticated /snapshot or /screen endpoint that returns JPEG images of the current screen via simple GET requests. A remote attacker can invoke these endpoints without credentials and retrieve real‑time screen content, potentially exposing sensitive data displayed on the device.

The vulnerability affects the Viewsonic vCast media streaming service. No specific version information is provided; the issue is present in any affected instance of the product until a vendor patch is released.

Because the endpoints are reachable without authentication, any host within the network or on an exposed port can capture and exfiltrate screen data. The EPSS score of < 1% and the CVSS score of 7.5 indicate a moderate exploitation probability and a medium to high severity, while the lack of listing in the CISA KEV catalog suggests it is not yet widely known. Nevertheless, the potential for indiscriminate information disclosure makes the risk significant, especially in environments where the screen contains confidential material.