CVE-2026-103038
PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field…
- Risk score
- 69/100
- CVSS
- 8.6 v4.0
- Exploit chance (30 days)
- 3.4%
- Published
- 19 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- PingTools Network Utilities 4.64 has an OS command injection vulnerability in the Host field of a Watcher ICMP service, allowing a local attacker to inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.
- Affected
- {'products': ['PingTools Network Utilities'], 'packages': [], 'versions': ['4.64']}
- Fix
- Upgrade to a fixed version, or check the linked advisory for mitigation instructions.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.6 high
References
Original description
PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.
Last activity 19 Oct 2026. Patch Forecast updates every hour.