EUVD-2026-104454
GHSA-q2g8-5qrj-9x48
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess PingTools Watcher ICMP config locally
-
ExploitEnter shell metacharacters in Host field
-
ExecutionValue concatenated into sh -c command string
-
ImpactExecute arbitrary commands in app context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local access to the PingTools Network Utilities app and the ability to set or influence the Host field of a Watcher ICMP service; that field accepts arbitrary values that are incorporated unsanitized into a command string run as sh -c. Limiting factors: the CVSS vector is AV:L, so exploitation is local to the device/app rather than remote, and it depends on configuring or triggering the Watcher ICMP feature specifically - it is not a default-path remote network scenario. |
| Impact | The input CVSS 4.0 base score is 8.6 (High), but the vector is AV:L (local attack vector), which materially tempers real-world risk: exploitation requires local interaction with the PingTools app on the device rather than remote network reach, so this is not internet-facing mass-exploitable. The vector shows AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity and availability impact (VC:H/VI:H/VA:H) confined to the vulnerable system (SC:N/SI:N/SA:N), consistent with a local OS command injection (CWE-78) executed via sh -c. No EPSS score was provided, KEV status is NO (not listed by CISA), and no POC flag was supplied, so there is no signal of active or widespread exploitation. The signals are broadly consistent (high technical impact but local-only), so this reads as a genuine but lower-urgency defect rather than an emergency - a high CVSS driven by impact metrics, not by ease of remote exploitation. The local vector limits automatability and scale, pointing toward targeted or self/adjacent exploitation rather than opportunistic campaigns. |
| Exploit ScenarioDerived | A user, or an attacker with local access to the device (or who can seed a crafted configuration), enters shell metacharacters into the Host field of a Watcher ICMP service in PingTools Network Utilities 4.64 Free; because the value is concatenated into a command string executed as sh -c, the injected commands run in the app's context. No public exploit was identified in the provided data, though the reporting Fluid Attacks advisory may contain technical detail. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Command injection in PingTools Network Utilities 4.64 Free allows a local user who can set or influence the Host field of a Watcher ICMP service to run arbitrary commands through sh -c, compromising confidentiality, integrity, and availability. The assessed vector is AV:L, so this is a local-device issue requiring access to the app and configuration or triggering of the Watcher ICMP feature, not an internet-facing remote attack. No public exploit code or CISA KEV entry was identified in the provided data.
RemediationAI
No vendor-released patch identified at time of analysis. Until a fixed release is available, avoid entering untrusted or attacker-influenced values in the Watcher ICMP Host field and restrict local access to the app to trusted users; where feasible, disable the Watcher ICMP feature if it is not required, accepting loss of that monitoring capability. Enforce hostname/IP allowlisting via managed app configuration or device management if supported, and monitor for unexpected sh child processes or command strings containing shell metacharacters; these controls reduce exposure but do not eliminate the injection until the vendor patches it. Consult the Fluid Attacks advisory at https://fluidattacks.com/advisories/yanderechainsawregurgitationfactory and the Google Play listing at https://play.google.com/store/apps/details?id=ua.com.streamsoft.pingtools for updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-78 OS command injection in Streamsoft PingTools Network Utilities, an Android network utilities app distributed via Google Play. The CPE cpe:2.3:a:streamsoft:pingtools_network_utilities:*:*:*:*:*:*:*:* points to the Streamsoft product family, and the advisory identifies version 4.64 Free as affected. The Watcher ICMP service accepts an arbitrary Host value and incorporates it into a command string executed as sh -c without sanitization, so shell metacharacters in that field can break out of the intended ping/ICMP command and execute attacker-controlled commands under the app's process privileges. The CVSS 4.0 vector is AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, and the independent assessment maps to CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Know when Pingtools Network Utilities gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local app input injection into sh -c yields AV:L; no authentication to the app gives PR:N with no interaction beyond supplying the field, and full command execution gives C/I/A High.
Primary rating from Vendor (Fluid Attacks).
CVSS VectorVendor: Fluid Attacks
DescriptionCVE.org
PingTools Network Utilities 4.64 Free accepts an arbitrary value in the Host field of a Watcher ICMP service, incorporating that value into a command string executed as sh -c.
Executive ViewAI
PingTools Network Utilities 4.64 Free exposes managed endpoints to local command injection through the Watcher ICMP Host field, allowing a user with local access to run arbitrary commands under the application's privileges and putting device confidentiality, integrity, and availability at risk. At time of analysis there is no vendor-released patch and no public exploit identified at time of analysis, so exposure is limited to locally accessible systems rather than internet-facing services. Leadership should treat this as an endpoint software inventory and least-privilege issue, since unsanctioned free network utilities widen the attack surface and complicate remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or restrict the Watcher ICMP Host field configuration, enforce least privilege and remove unnecessary local admin rights, apply application allowlisting to block PingTools 4.64 Free on managed endpoints, monitor endpoint telemetry for sh -c child processes spawned by the application, and uninstall the utility where it is not business-justified.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB