PingTools Network Utilities 4.64 for Android contains an OS command injection flaw in the Host field of the Watcher ICMP service. The application concatenates the attacker‑controlled Host value into a ping command, serializes the command as a single string, and executes it through sh -c; a local attacker who can create or modify a Watcher service can inject shell syntax and run arbitrary commands with the app’s privileges. This loss of integrity allows the attacker to fully compromise the device under the application’s UID, potentially exfiltrating data or installing additional malware.

Affected is the StreamSoft PingTools Network Utilities application, version 4.64. This is the only listed vendor and product, running on Android devices. No additional sub‑versions are mentioned.

The flaw is rated high with a CVSS score of 8.6. EPSS is 3% and the vulnerability is not listed in the CISA KEV catalog, indicating it has not been observed in the wild. An attacker with the ability to supply a crafted Host value through the Watcher ICMP service can inject shell syntax, leading to arbitrary command execution under the PingTools application UID. Successful exploitation grants unrestricted code execution with the app’s privileges, potentially enabling full device compromise.