{"id":"CVE-2026-103038","kind":"vulnerability","aliases":["CVE-2026-103038"],"related":[],"title":"PingTools Network Utilities: Watcher Host field runs injected shell commands","description":"PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.","summary":"PingTools Network Utilities (StreamSoft, Android package ua.com.streamsoft.pingtools) 4.64 Free passes the Host field of a Watcher ICMP service to 'sh -c ping ...' unsanitized. Whoever can create or edit a Watcher service (or restore a Watcher backup) can run commands as the app's UID, inside the Android sandbox. It gives no root and no access to other apps' data. The Watcher service is not exported, so other apps cannot reach it directly. The researcher published a step-by-step PoC. No vendor fix is known.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"PingTools Network Utilities","fixed":[],"affected":"4.64 Free (versionCode 464)","ecosystem":"android"}],"ecosystems":[],"tags":["android","command-injection","local","other","pingtools"],"not_affected_if":["no-watcher-services","not-installed","other-versions","watcher-unused"],"how_to_check":"On the Android device, open Settings > Apps > PingTools and check the version. 4.64 Free (versionCode 464) is the affected build. Also look for Watcher tasks with ICMP services whose Host contains shell characters (; | > $ backticks) and for Watcher backups you did not create.","fix":"No fixed version found; the vendor was contacted on Sep 29, 2026 and has not published one. Check Google Play for a newer build than 4.64. Until then, do not import untrusted Watcher backups, delete ICMP Watcher services with odd Host values, or uninstall the app. Fluid Attacks recommends the vendor drop 'sh -c' and validate Host as a hostname or IP address.","status":"open","published_at":"2026-10-19T17:17:00+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-23T22:39:46+00:00","updated_at":"2026-10-24T00:22:30+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:39:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"PingTools Network Utilities: Watcher Host field runs injected shell commands","impact":"high","summary":"PingTools Network Utilities 4.64 passes the Host value of a Watcher ICMP service into a shell command without sanitizing it. A local attacker who can create or edit a Watcher service can run arbitrary commands under the app's user ID with its Android permissions.","category":"other","who_cares":["android","pingtools"],"confidence":0.7,"needs_auth":"yes","worst_case":"Commands run as the app user, with its granted Android permissions.","analyst_note":"Check the NVD entry and vendor for a fixed version and whether the Watcher feature is on by default; the sources do not name a fixed release.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-watcher-services","other-versions"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000466,"input_tokens":2957,"output_tokens":340,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and vendor for a fixed version and whether the Watcher feature is on by default; the sources do not name a fixed release.","search":"'-103038':13A,16A '-2026':12A,15A '4.64':34B,116C 'access':81B 'android':20B,31B,73B,185C 'app':68B,84B,94B 'append':134C 'applic':133C,180C 'arbitrari':175C 'attack':137C,160C 'attacker-control':136C 'backup':62B 'c':47B,157C 'cannot':95B 'command':10A,22B,65B,120C,144C,147C,176C 'command-inject':21B 'contain':117C 'control':138C 'creat':52B,163C 'cve':11A,14A 'data':85B 'direct':98B 'edit':54B 'execut':153C,174C 'export':91B 'field':6A,39B,126C 'fix':110B 'free':35B 'give':76B 'grant':184C 'host':5A,38B,125C,139C 'icmp':43B,130C 'inject':8A,23B,121C,170C 'insid':71B 'known':112B 'local':24B,159C 'modifi':165C 'network':2A,18A,28B,114C 'os':119C 'packag':32B 'pass':36B 'permiss':186C 'ping':48B,143C 'pingtool':1A,26B,27B,113C,179C 'pingtools':17A 'poc':107B 'publish':101B 'reach':96B 'research':100B 'restor':59B 'root':78B 'run':7A,64B 'sandbox':74B 'serial':145C 'servic':44B,57B,88B,131C,168C 'sh':46B,156C 'shell':9A,171C 'singl':150C 'step':104B,106B 'step-by-step':103B 'streamsoft':30B 'string':151C 'syntax':172C 'ua.com.streamsoft.pingtools':33B 'uid':70B,181C 'unsanit':49B 'util':3A,29B,115C 'utilities':19A 'valu':140C 'vendor':109B 'vulner':122C 'watcher':4A,42B,56B,61B,87B,129C,167C 'whoever':50B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"help@fluidattacks.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-103038","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103038","severity":null,"published_at":"2026-10-19T17:17:00+00:00","modified_at":"2026-10-20T20:17:11+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-103038:645","url":null,"severity":null,"published_at":"2026-10-24T00:22:30+00:00","modified_at":"2026-10-24T00:22:30+00:00","first_seen_at":"2026-10-24T00:22:30+00:00","fetched_at":"2026-10-24T00:22:30+00:00","note":"Read Fluid Attacks advisory (primary, with PoC steps): PingTools 4.64 Free only; vendor StreamSoft contacted Sep 29, no fixed version published or found. Not on KEV, no in-the-wild exploitation seen. Not searched social: obscure app."}],"documents":[{"id":2570,"url":"https://fluidattacks.com/advisories/yanderechainsawregurgitationfactory","title":"Fluid Attacks: PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP host","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2571,"url":"https://www.cve.org/CVERecord?id=CVE-2026-103038","title":"CVE Record: CVE-2026-103038","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":2570,"url":"https://fluidattacks.com/advisories/yanderechainsawregurgitationfactory","title":"Fluid Attacks: PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP host","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}