PingTools Network Utilities 4.64 for Android contains an OS command injection flaw that allows an attacker to supply a crafted value in the Host field of the Watcher ICMP service. The application concatenates that value into a shell command string executed with sh -c, giving the attacker the ability to run arbitrary shell commands on the device. If exploited, the attacker can obtain full system compromise, exfiltrate data, and install additional malware.

Affected is the StreamSoft PingTools Network Utilities application, version 4.64. This is the only listed vendor and product, running on Android devices. No additional sub‑versions are mentioned.

The flaw is rated high with a CVSS score of 8.6. The EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, implying it has not yet been observed in the wild. The likely attack vector involves remote interaction with the Watcher ICMP service through the Host input field, which may be reachable via the application’s interface or a malicious payload. Successful exploitation would result in unrestricted code execution with the privileges of the running application, potentially escalating to full device control.