Dashboard / CVE-2026-103038

CVE-2026-103038

HIGH
MEDIUM Priority: 0.30 BB Relevance: 53/100
Published: 2026-10-19 Modified: 2026-11-11 First seen: 2026-11-11 Status: active

Attack Surface

Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: None
S: X
AT: None
VC: High
VI: High
VA: High

Description

PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
StreamSoft PingTools Network Utilities 4.64

References & Advisories (2)

https://fluidattacks.com/advisories/yanderechainsawregurgitationfactory
third-party-advisory technical-description mitigation

Bug Bounty Relevance

53 / 100
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

8.6 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

3.44%
Raw Score 0.034410
Percentile 89.2%
Date 2026-11-13

EPSS Trend

2026-11-13
0.03441
2026-11-12
0.03441
2026-11-10
0.03441

Intelligence Sources

mitre ref →
nvd ref →

External Links