PingTools Network Utilities: OS command injection in Watcher ICMP host
Summary
PingTools Network Utilities 4.64 for Android passes the Host field of a Watcher ICMP service unescaped to a shell (sh -c). A local attacker who can create or modify a Watcher service can inject shell syntax and run arbitrary commands with the app's UID and Android permissions. The CNA rates the CVSS 4.0 base score at 8.6, while VulDB lists 6.3, and NVD analysis is still pending.
Affected
- StreamSoft PingTools Network Utilities 4.64 (Free edition, Android package ua.com.streamsoft.pingtools)
- Whether other versions are affected: Unknown.
Fixed in
Unknown. No fixed version number has been published in the sources reviewed.
Workaround
- Do not import untrusted Watcher backups.
- Do not enter untrusted values in Watcher ICMP Host fields.
- Review existing Watcher entries for unexpected or malformed Host values.
- Limit the app's Android permissions to what it needs.
- No vendor-issued workaround is known.
Exploitation
- Not known to be exploited in the wild.
- CISA SSVC: exploitation none, automatable no.
- Not listed in the CISA KEV catalogue.
- A public proof of concept is claimed by an aggregator but could not be verified.
Our recommendation
- Check whether managed Android phones or tablets have PingTools installed.
- Update the app to the latest version from the Google Play Store once a fixed release is confirmed, or uninstall it if it is not needed.
- Use mobile device management to restrict who can install or configure the app.
- Monitor the vendor and Fluid Attacks for a fixed version and NVD analysis.
- Priority: low to medium, as the attack is local and limited to the app's sandbox.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fluid Attacks advisory fluidattacks.com
- Google Play Store listing play.google.com
- VulDB entry vuldb.com
- OpenCVE CVE-2026-103038 app.opencve.io
- Strix CVE-2026-103038 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:46.
Original description (NVD)
PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.