# CVE-2026-103038: PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP host

Status: published. Published: 2026-10-19. Updated: 2026-11-11.

PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.

## Remediation

- fix: Replace the sh -c execution path with a process API that accepts an argument list and preserves the validated Host as one argument. Validate Host as a supported DNS name or IPv4/IPv6 address in both the Watcher editor and backup-import path, reject shell syntax, whitespace and option-like input, add regression tests, backport the correction, and upgrade to the first fixed release when it becomes available. Until then, do not import untrusted Watcher backups and do not enter untrusted values in Watcher ICMP Host fields. (source: CNA: Fluid Attacks)

## Affected products and versions

- StreamSoft / PingTools Network Utilities: 4.64 (affected, custom). Source: CNA: Fluid Attacks; platforms: Android

## Severity and prioritization

- CVSS 4.0: 8.6 (high); CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N; source: CNA: Fluid Attacks

- CISA KEV: No listing in collected sources

- EPSS: 3.44% as of 2026-11-10; percentile 89.08%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-78

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://fluidattacks.com/advisories/yanderechainsawregurgitationfactory (CNA: Fluid Attacks; third-party-advisory, technical-description, mitigation)

- https://play.google.com/store/apps/details?id=ua.com.streamsoft.pingtools (CNA: Fluid Attacks; product)

## Provenance

- CNA: Fluid Attacks: https://www.cve.org/CVERecord?id=CVE-2026-103038; retrieved 2026-11-11; source updated 2026-11-11

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-103038; retrieved 2026-11-11; source updated Not reported

Revision: d10301ad976d12656db81a660d61517364a81f746be6d9299c890112fd77a2da

Canonical: https://y2.dev/cve/CVE-2026-103038

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.