Loftware Spectrum before 4.6 HF14 has Missing Authentication for a Critical Function.
Priority MEDIUM 50CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-287.
Summary
Loftware Spectrum before 4.6 HF14 has Missing Authentication for a Critical Function.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00579 47th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:loftware:spectrum:*:-:*:*:*:*:*:* | before 4.6 | Vulnerable | Loftware |
| cpe:2.3:a:loftware:spectrum:4.6:-:*:*:*:*:*:* | 4.6 | Vulnerable | Loftware |
| cpe:2.3:a:loftware:spectrum:4.6:feature_pack6:*:*:*:*:*:* | 4.6 feature_pack6 | Vulnerable | Loftware |
| cpe:2.3:a:loftware:spectrum:4.6:hotfix1:*:*:*:*:*:* | 4.6 hotfix1 | Vulnerable | Loftware |
| cpe:2.3:a:loftware:spectrum:4.6:hotfix10:*:*:*:*:*:* | 4.6 hotfix10 | Vulnerable | Loftware |
| cpe:2.3:a:loftware:spectrum:4.6:hotfix12:*:*:*:*:*:* | 4.6 hotfix12 | Vulnerable | Loftware |
| cpe:2.3:a:loftware:spectrum:4.6:hotfix13:*:*:*:*:*:* | 4.6 hotfix13 | Vulnerable | Loftware |
| cpe:2.3:a:loftware:spectrum:4.6:hotfix2:*:*:*:*:*:* | 4.6 hotfix2 | Vulnerable | Loftware |
| cpe:2.3:a:loftware:spectrum:4.6:hotfix3:*:*:*:*:*:* | 4.6 hotfix3 | Vulnerable | Loftware |
| cpe:2.3:a:loftware:spectrum:4.6:hotfix4:*:*:*:*:*:* | 4.6 hotfix4 | Vulnerable | Loftware |
- cpe:2.3:a:loftware:spectrum:*:-:*:*:*:*:*:* Versions before 4.6 Vulnerable ·Loftware
- cpe:2.3:a:loftware:spectrum:4.6:-:*:*:*:*:*:* Versions 4.6 Vulnerable ·Loftware
- cpe:2.3:a:loftware:spectrum:4.6:feature_pack6:*:*:*:*:*:* Versions 4.6 feature_pack6 Vulnerable ·Loftware
- cpe:2.3:a:loftware:spectrum:4.6:hotfix1:*:*:*:*:*:* Versions 4.6 hotfix1 Vulnerable ·Loftware
- cpe:2.3:a:loftware:spectrum:4.6:hotfix10:*:*:*:*:*:* Versions 4.6 hotfix10 Vulnerable ·Loftware
- cpe:2.3:a:loftware:spectrum:4.6:hotfix12:*:*:*:*:*:* Versions 4.6 hotfix12 Vulnerable ·Loftware
- cpe:2.3:a:loftware:spectrum:4.6:hotfix13:*:*:*:*:*:* Versions 4.6 hotfix13 Vulnerable ·Loftware
- cpe:2.3:a:loftware:spectrum:4.6:hotfix2:*:*:*:*:*:* Versions 4.6 hotfix2 Vulnerable ·Loftware
- cpe:2.3:a:loftware:spectrum:4.6:hotfix3:*:*:*:*:*:* Versions 4.6 hotfix3 Vulnerable ·Loftware
- cpe:2.3:a:loftware:spectrum:4.6:hotfix4:*:*:*:*:*:* Versions 4.6 hotfix4 Vulnerable ·Loftware
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:loftware:spectrum:4.6:hotfix5:*:*:*:*:*:* | 4.6 hotfix5 | Vulnerable | Loftware |
| cpe:2.3:a:loftware:spectrum:4.6:hotfix7:*:*:*:*:*:* | 4.6 hotfix7 | Vulnerable | Loftware |
| cpe:2.3:a:loftware:spectrum:4.6:hotfix8:*:*:*:*:*:* | 4.6 hotfix8 | Vulnerable | Loftware |
| cpe:2.3:a:loftware:spectrum:4.6:hotfix9:*:*:*:*:*:* | 4.6 hotfix9 | Vulnerable | Loftware |
- cpe:2.3:a:loftware:spectrum:4.6:hotfix5:*:*:*:*:*:* Versions 4.6 hotfix5 Vulnerable ·Loftware
- cpe:2.3:a:loftware:spectrum:4.6:hotfix7:*:*:*:*:*:* Versions 4.6 hotfix7 Vulnerable ·Loftware
- cpe:2.3:a:loftware:spectrum:4.6:hotfix8:*:*:*:*:*:* Versions 4.6 hotfix8 Vulnerable ·Loftware
- cpe:2.3:a:loftware:spectrum:4.6:hotfix9:*:*:*:*:*:* Versions 4.6 hotfix9 Vulnerable ·Loftware
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-37226
- 2026-10-03 Alias added: GHSA-8635-cr25-p8xq
References
More Loftware Spectrum vulnerabilities
- TI-2023-18860 Loftware Spectrum before 4.6 HF13 Deserializes Untrusted Data. CVSS 3.1CRITICAL 9.8
- TI-2023-18863 Loftware Spectrum before 4.6 HF14 uses a Hard-coded Password. CVSS 3.1CRITICAL 9.8
- TI-2023-18866 Loftware Spectrum through 4.6 has unprotected JMX Registry. CVSS 3.1CRITICAL 9.8
- TI-2023-18865 Loftware Spectrum before 4.6 HF14 allows authenticated XXE attacks. CVSS 3.1HIGH 8.8
- TI-2023-18862 Loftware Spectrum (testDeviceConnection) before 5.1 allows SSRF. CVSS 3.1HIGH 8.8
- TI-2023-18861 Loftware Spectrum before 5.1 allows SSRF. CVSS 3.1HIGH 8.8
Sources
- CVE-2023-37226 · CVE Program
- CVE-2023-37226 · NVD
- FIRST EPSS
- GHSA-8635-cr25-p8xq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences