Live › vulnerability › CVE-2026-103038
Go to dashboardPingTools Network Utilities (StreamSoft, Android package ua.com.streamsoft.pingtools) 4.64 Free passes the Host field of a Watcher ICMP service to 'sh -c ping ...' unsanitized. Whoever can create or edit a Watcher service (or restore a Watcher backup) can run commands as the app's UID, inside the Android sandbox. It gives no root and no access to other apps' data. The Watcher service is not exported, so other apps cannot reach it directly. The researcher published a step-by-step PoC. No vendor fix is known.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| PingTools Network Utilities | android | 4.64 Free (versionCode 464) | – |
sh -c and validate Host as a hostname or IP addressEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.
This page as .md · .json · in your agent: get_signal("CVE-2026-103038")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.