---
id: "CVE-2026-103038"
kind: "vulnerability"
aliases: ["CVE-2026-103038"]
title: "PingTools Network Utilities: Watcher Host field runs injected shell commands"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "PingTools Network Utilities", "fixed": [], "affected": "4.64 Free (versionCode 464)", "ecosystem": "android"}]
ecosystems: []
tags: ["android", "command-injection", "local", "other", "pingtools"]
not_affected_if: ["no-watcher-services", "not-installed", "other-versions", "watcher-unused"]
published_at: "2026-10-19T17:17:00+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-24T00:22:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103038", "first_seen_at": "2026-10-23T21:57:18+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:22:30+00:00"}]
---

# PingTools Network Utilities: Watcher Host field runs injected shell commands

PingTools Network Utilities (StreamSoft, Android package ua.com.streamsoft.pingtools) 4.64 Free passes the Host field of a Watcher ICMP service to 'sh -c ping ...' unsanitized. Whoever can create or edit a Watcher service (or restore a Watcher backup) can run commands as the app's UID, inside the Android sandbox. It gives no root and no access to other apps' data. The Watcher service is not exported, so other apps cannot reach it directly. The researcher published a step-by-step PoC. No vendor fix is known.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- android:PingTools Network Utilities affected 4.64 Free (versionCode 464) fixed ?

## How to check

On the Android device, open Settings > Apps > PingTools and check the version. 4.64 Free (versionCode 464) is the affected build. Also look for Watcher tasks with ICMP services whose Host contains shell characters (; | > $ backticks) and for Watcher backups you did not create.

## Fix

No fixed version found; the vendor was contacted on Sep 29, 2026 and has not published one. Check Google Play for a newer build than 4.64. Until then, do not import untrusted Watcher backups, delete ICMP Watcher services with odd Host values, or uninstall the app. Fluid Attacks recommends the vendor drop 'sh -c' and validate Host as a hostname or IP address.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103038
- 2026-10-24T00:22:30+00:00 analyst — Read Fluid Attacks advisory (primary, with PoC steps): PingTools 4.64 Free only; vendor StreamSoft contacted Sep 29, no fixed version published or found. Not on KEV, no in-the-wild exploitation seen. Not searched social: obscure app.

## Documents

- [advisory] Fluid Attacks: PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP host https://fluidattacks.com/advisories/yanderechainsawregurgitationfactory
- [mentions] CVE Record: CVE-2026-103038 https://www.cve.org/CVERecord?id=CVE-2026-103038
- [poc] Fluid Attacks: PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP host https://fluidattacks.com/advisories/yanderechainsawregurgitationfactory

## From the sources

PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_