PT-2026-4648 · Lcg0124 · Bootdo

Tom132432 · Published 2026-01-25 · Updated 2026-01-25 · CVE-2026-1406

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions lcg0124 BootDo versions prior to 5ccd963c74058036b466e038cff37de4056c1600

Description An open redirect issue exists in lcg0124 BootDo. The vulnerability is related to the manipulation of the Hostname argument within the redirectToLogin function of the AccessControlFilter.java file, part of the Host Header Handler component. This manipulation can lead to an open redirect, and the attack can be initiated remotely. The exploit has been publicly disclosed.

Recommendations Versions prior to 5ccd963c74058036b466e038cff37de4056c1600 should be updated. As a temporary workaround, consider restricting or disabling the redirectToLogin function until an update is available.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-1406

Affected Products

Bootdo

References · 9

• 🔥 https://github.com/webzzaa/CVE-/issues/5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1406 · Security Note
• https://vuldb.com/?ctiid.342794 · Note
• https://twitter.com/vuldb/status/2015454254581092516 · Twitter Post
• https://twitter.com/CVEnew/status/2015448665498759414 · Twitter Post
• https://t.me/cveNotify/149802 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2015403565418680416 · Twitter Post
• https://vuldb.com/?submit.736271 · Note
• https://vuldb.com/?id.342794 · Note