CVE-2026-103038
Description
A flaw was found in PingTools. The application incorporates arbitrary input from the Host field of a Watcher Internet Control Message Protocol (ICMP) service directly into a system shell command without adequate sanitization. A local attacker can exploit this vulnerability to execute arbitrary commands with the privileges of the application.
Statement
This vulnerability is evaluated as an Important impact because an authenticated local attacker can leverage unvalidated parameters to trigger arbitrary command execution within the running application process, bypassing normal input constraints without requiring elevated permissions. However, PingTools is a third-party mobile utility application and is not included, shipped, or supported in Red Hat Enterprise Linux or any other Red Hat product. As a result, Red Hat enterprise platforms are not affected by this flaw.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
