---
id: CVE-2026-103038
title: >-
  PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP
  host
summary: >-
  PingTools Network Utilities 4.64 Free accepts an arbitrary value in the Host
  field of a Watcher ICMP service, incorporating that value into a command
  string executed as sh -c.
severity: high
cvss: 8.6
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-78
vendor: StreamSoft
product: PingTools Network Utilities
affected:
  - pingtools_network_utilities 4.64
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T16:13:35.444Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-103038'
references:
  - url: 'https://fluidattacks.com/advisories/yanderechainsawregurgitationfactory'
  - url: 'https://play.google.com/store/apps/details?id=ua.com.streamsoft.pingtools'
tags:
  - cve.org
ingestedAt: '2026-10-19T17:33:42.480Z'
---

## Overview

PingTools Network Utilities 4.64 Free accepts an arbitrary value in the Host field of a Watcher ICMP service, incorporating that value into a command string executed as sh -c.

## Affected

- `pingtools_network_utilities 4.64`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.