CVE-2026-103038

8.6High

Published 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

8.6High

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

A local attacker can execute arbitrary shell commands with the app's privileges. They only need local access to supply input into the Host field of the Watcher ICMP service.

Root cause

The application unsafely interpolates user-controlled host input directly into an 'sh -c' command string without sanitization.

Affected systems

PingTools Network Utilities 4.64 Free

CVSS v4.0 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix & remediation

Fixed version not specified in the advisory; stop using the Watcher ICMP service or uninstall the application until a patched release is published on Google Play.

shell

$ adb uninstall ua.com.streamsoft.pingtools

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

PingTools Network Utilities 4.64 Free accepts an arbitrary value in the Host field of a Watcher ICMP service, incorporating that value into a command string executed as sh -c.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-103038