CVE-2026-103038

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103038", "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "state": "PUBLISHED", "assignerShortName": "Fluid Attacks", "dateReserved": "2026-09-29T21:35:56.544Z", "datePublished": "2026-10-19T16:13:35.444Z", "dateUpdated": "2026-11-11T21:34:36.705Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "shortName": "Fluid Attacks", "dateUpdated": "2026-11-11T21:34:36.705Z"}, "title": "PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP host", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Successful exploitation lets an attacker execute commands as the PingTools application UID, read or alter application-accessible data, use the application's outbound network access, and disrupt the application. The commands remain confined by the Android application sandbox."}]}], "affected": [{"vendor": "StreamSoft", "product": "PingTools Network Utilities", "platforms": ["Android"], "versions": [{"status": "affected", "version": "4.64", "versionType": "custom"}], "defaultStatus": "unaffected", "cpes": ["cpe:2.3:a:streamsoft:pingtools_network_utilities:4.64:*:*:*:*:android:*:*"]}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:streamsoft:pingtools_network_utilities:4.64:*:android:*:*:*:*:*"}]}]}], "descriptions": [{"lang": "en", "value": "PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.</p>"}]}], "references": [{"url": "https://fluidattacks.com/advisories/yanderechainsawregurgitationfactory", "tags": ["third-party-advisory", "technical-description", "mitigation"]}, {"url": "https://play.google.com/store/apps/details?id=ua.com.streamsoft.pingtools", "tags": ["product"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.6, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Replace the sh -c execution path with a process API that accepts an argument list and preserves the validated Host as one argument. Validate Host as a supported DNS name or IPv4/IPv6 address in both the Watcher editor and backup-import path, reject shell syntax, whitespace and option-like input, add regression tests, backport the correction, and upgrade to the first fixed release when it becomes available. Until then, do not import untrusted Watcher backups and do not enter untrusted values in Watcher ICMP Host fields.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Replace the sh -c execution path with a process API that accepts an argument list and preserves the validated Host as one argument. Validate Host as a supported DNS name or IPv4/IPv6 address in both the Watcher editor and backup-import path, reject shell syntax, whitespace and option-like input, add regression tests, backport the correction, and upgrade to the first fixed release when it becomes available. Until then, do not import untrusted Watcher backups and do not enter untrusted values in Watcher ICMP Host fields.</p>"}]}], "credits": [{"lang": "en", "value": "Andr\u00e9s Ramos", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-20T19:29:21.457795Z", "id": "CVE-2026-103038", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T19:29:29.488Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-103038", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-20T19:29:21.457795Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T19:29:25.563Z"}}], "cna": {"title": "PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP host", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Andr\u00e9s Ramos"}], "impacts": [{"descriptions": [{"lang": "en", "value": "Successful exploitation lets an attacker execute commands as the PingTools application UID, read or alter application-accessible data, use the application's outbound network access, and disrupt the application. The commands remain confined by the Android application sandbox."}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:streamsoft:pingtools_network_utilities:4.64:*:*:*:*:android:*:*"], "vendor": "StreamSoft", "product": "PingTools Network Utilities", "versions": [{"status": "affected", "version": "4.64", "versionType": "custom"}], "platforms": ["Android"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Replace the sh -c execution path with a process API that accepts an argument list and preserves the validated Host as one argument. Validate Host as a supported DNS name or IPv4/IPv6 address in both the Watcher editor and backup-import path, reject shell syntax, whitespace and option-like input, add regression tests, backport the correction, and upgrade to the first fixed release when it becomes available. Until then, do not import untrusted Watcher backups and do not enter untrusted values in Watcher ICMP Host fields.", "supportingMedia": [{"type": "text/html", "value": "<p>Replace the sh -c execution path with a process API that accepts an argument list and preserves the validated Host as one argument. Validate Host as a supported DNS name or IPv4/IPv6 address in both the Watcher editor and backup-import path, reject shell syntax, whitespace and option-like input, add regression tests, backport the correction, and upgrade to the first fixed release when it becomes available. Until then, do not import untrusted Watcher backups and do not enter untrusted values in Watcher ICMP Host fields.</p>", "base64": false}]}], "references": [{"url": "https://fluidattacks.com/advisories/yanderechainsawregurgitationfactory", "tags": ["third-party-advisory", "technical-description", "mitigation"]}, {"url": "https://play.google.com/store/apps/details?id=ua.com.streamsoft.pingtools", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.", "supportingMedia": [{"type": "text/html", "value": "<p>PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:streamsoft:pingtools_network_utilities:4.64:*:android:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "shortName": "Fluid Attacks", "dateUpdated": "2026-11-11T21:34:36.705Z"}}}, "cveMetadata": {"cveId": "CVE-2026-103038", "state": "PUBLISHED", "dateUpdated": "2026-11-11T21:34:36.705Z", "dateReserved": "2026-09-29T21:35:56.544Z", "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "datePublished": "2026-10-19T16:13:35.444Z", "assignerShortName": "Fluid Attacks"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:streamsoft:pingtools_network_utilities:4.64:*:*:*:*:android:*:*"], "defaultStatus": "unaffected", "platforms": ["Android"], "product": "PingTools Network Utilities", "vendor": "StreamSoft", "versions": [{"status": "affected", "version": "4.64", "versionType": "custom"}]}], "source": "help@fluidattacks.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions."}], "id": "CVE-2026-103038", "lastModified": "2026-11-11T22:17:10.650", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "help@fluidattacks.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-103038", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-20T19:29:21.457795Z", "version": "2.0.3"}}]}, "published": "2026-10-19T17:17:00.400", "references": [{"source": "help@fluidattacks.com", "url": "https://fluidattacks.com/advisories/yanderechainsawregurgitationfactory"}, {"source": "help@fluidattacks.com", "url": "https://play.google.com/store/apps/details?id=ua.com.streamsoft.pingtools"}], "sourceIdentifier": "help@fluidattacks.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "help@fluidattacks.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["android"], "status": "affected", "versions": {"scheme": "generic", "value": "4.64"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "PingTools Network Utilities", "source": "cna", "vendor": "StreamSoft"}, "product": "pingtools_network_utilities", "vendor": "streamsoft"}], "created": "2026-10-19T17:30:13.903210+00:00", "updated": "2026-10-21T16:58:18.616647+00:00", "vendors": ["streamsoft", "streamsoft$PRODUCT$pingtools_network_utilities"]}