Vulnerability · Published Oct 19, 2026 · Assigned by Fluid Attacks
CVE-2026-103038PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP host
High 8.6
In plain English
A high-severity OS command injection in PingTools Network Utilities from StreamSoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.4% (higher than 89% of all known vulnerabilities).
Official description
PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| StreamSoft | PingTools Network Utilities | 4.64 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://fluidattacks.com/advisories/yanderechainsawregurgitationfactory third-party-advisory, technical-description, mitigation
- https://play.google.com/store/apps/details?id=ua.com.streamsoft.pingtools product