CVE-2026-103038

Name of the Vulnerable Software and Affected Versions PingTools Network Utilities version 4.64

Description The application contains an OS command injection flaw within the Watcher ICMP service. A local attacker capable of creating or modifying a Watcher service can provide an arbitrary value in the Host field. This value is appended to a ping command, serialized as a single string, and executed via sh -c, allowing the execution of arbitrary commands with the application UID and its associated Android permissions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.