CVE-2026-103038

UNKNOWN 0.0

PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP host

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.

CWE	CWE-78
Vendor	streamsoft
Product	pingtools network utilities
Published	Oct 19, 2026
Last Updated	Oct 19, 2026

Stay Ahead of the Next One

Get instant alerts for streamsoft pingtools network utilities

Be the first to know when new unknown vulnerabilities affecting streamsoft pingtools network utilities are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

StreamSoft / PingTools Network Utilities

4.64

References

NVD ↗ CVE.org ↗ EPSS Data ↗

fluidattacks.com: https://fluidattacks.com/advisories/yanderechainsawregurgitationfactory play.google.com: https://play.google.com/store/apps/details?id=ua.com.streamsoft.pingtools

Credits

Andrés Ramos