The reported vulnerability resides in ViewSonic ViewBoard's vCast application. An unauthenticated download endpoint accepts arbitrary URLs, enabling a remote attacker to request any file from the server. When a malicious Android package is supplied, the platform trusts the response and installs it without requiring privileged rights or user consent. The installed application can then execute arbitrary commands, effectively granting remote code execution on the underlying operating system. This flaw exploits an improper access control weakness and enables attackers to compromise the device with minimal effort.

ViewSonic vCast products. No specific version information is provided.

The vulnerability has a CVSS score of 7.5, indicating high severity, while the EPSS score is below 1%, pointing to a low exploitation probability. It remains not listed in the CISA KEV catalog. The lack of authentication on the download endpoint allows an unauthenticated remote attacker to supply a URL that points to a malicious APK, which the system will install without privilege checks. This can lead to remote code execution on the device with minimal effort. Monitoring and access controls are recommended until a vendor patch becomes available.