Read the docs
TI-2023-18860 Aliases CVE-2023-37227GHSA-cgp2-rgv5-7hcp

Loftware Spectrum before 4.6 HF13 Deserializes Untrusted Data.

Priority MEDIUM 50CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-502.

Summary

Loftware Spectrum before 4.6 HF13 Deserializes Untrusted Data.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00617 49th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:loftware:spectrum:*:-:*:*:*:*:*:*before 4.6VulnerableLoftware
cpe:2.3:a:loftware:spectrum:4.6:-:*:*:*:*:*:*4.6VulnerableLoftware
cpe:2.3:a:loftware:spectrum:4.6:feature_pack6:*:*:*:*:*:*4.6 feature_pack6VulnerableLoftware
cpe:2.3:a:loftware:spectrum:4.6:hotfix1:*:*:*:*:*:*4.6 hotfix1VulnerableLoftware
cpe:2.3:a:loftware:spectrum:4.6:hotfix10:*:*:*:*:*:*4.6 hotfix10VulnerableLoftware
cpe:2.3:a:loftware:spectrum:4.6:hotfix12:*:*:*:*:*:*4.6 hotfix12VulnerableLoftware
cpe:2.3:a:loftware:spectrum:4.6:hotfix2:*:*:*:*:*:*4.6 hotfix2VulnerableLoftware
cpe:2.3:a:loftware:spectrum:4.6:hotfix3:*:*:*:*:*:*4.6 hotfix3VulnerableLoftware
cpe:2.3:a:loftware:spectrum:4.6:hotfix4:*:*:*:*:*:*4.6 hotfix4VulnerableLoftware
cpe:2.3:a:loftware:spectrum:4.6:hotfix5:*:*:*:*:*:*4.6 hotfix5VulnerableLoftware
  • cpe:2.3:a:loftware:spectrum:*:-:*:*:*:*:*:* Versions before 4.6 Vulnerable ·Loftware
  • cpe:2.3:a:loftware:spectrum:4.6:-:*:*:*:*:*:* Versions 4.6 Vulnerable ·Loftware
  • cpe:2.3:a:loftware:spectrum:4.6:feature_pack6:*:*:*:*:*:* Versions 4.6 feature_pack6 Vulnerable ·Loftware
  • cpe:2.3:a:loftware:spectrum:4.6:hotfix1:*:*:*:*:*:* Versions 4.6 hotfix1 Vulnerable ·Loftware
  • cpe:2.3:a:loftware:spectrum:4.6:hotfix10:*:*:*:*:*:* Versions 4.6 hotfix10 Vulnerable ·Loftware
  • cpe:2.3:a:loftware:spectrum:4.6:hotfix12:*:*:*:*:*:* Versions 4.6 hotfix12 Vulnerable ·Loftware
  • cpe:2.3:a:loftware:spectrum:4.6:hotfix2:*:*:*:*:*:* Versions 4.6 hotfix2 Vulnerable ·Loftware
  • cpe:2.3:a:loftware:spectrum:4.6:hotfix3:*:*:*:*:*:* Versions 4.6 hotfix3 Vulnerable ·Loftware
  • cpe:2.3:a:loftware:spectrum:4.6:hotfix4:*:*:*:*:*:* Versions 4.6 hotfix4 Vulnerable ·Loftware
  • cpe:2.3:a:loftware:spectrum:4.6:hotfix5:*:*:*:*:*:* Versions 4.6 hotfix5 Vulnerable ·Loftware
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:loftware:spectrum:4.6:hotfix7:*:*:*:*:*:*4.6 hotfix7VulnerableLoftware
cpe:2.3:a:loftware:spectrum:4.6:hotfix8:*:*:*:*:*:*4.6 hotfix8VulnerableLoftware
cpe:2.3:a:loftware:spectrum:4.6:hotfix9:*:*:*:*:*:*4.6 hotfix9VulnerableLoftware
  • cpe:2.3:a:loftware:spectrum:4.6:hotfix7:*:*:*:*:*:* Versions 4.6 hotfix7 Vulnerable ·Loftware
  • cpe:2.3:a:loftware:spectrum:4.6:hotfix8:*:*:*:*:*:* Versions 4.6 hotfix8 Vulnerable ·Loftware
  • cpe:2.3:a:loftware:spectrum:4.6:hotfix9:*:*:*:*:*:* Versions 4.6 hotfix9 Vulnerable ·Loftware

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-37227
  2. 2026-10-03 Alias added: GHSA-cgp2-rgv5-7hcp

References

Advisory 1

Other 2

  • TI-2023-18859 Loftware Spectrum before 4.6 HF14 has Missing Authentication for a Critical Function. CVSS 3.1CRITICAL 9.8
  • TI-2023-18863 Loftware Spectrum before 4.6 HF14 uses a Hard-coded Password. CVSS 3.1CRITICAL 9.8
  • TI-2023-18866 Loftware Spectrum through 4.6 has unprotected JMX Registry. CVSS 3.1CRITICAL 9.8
  • TI-2023-18865 Loftware Spectrum before 4.6 HF14 allows authenticated XXE attacks. CVSS 3.1HIGH 8.8
  • TI-2023-18862 Loftware Spectrum (testDeviceConnection) before 5.1 allows SSRF. CVSS 3.1HIGH 8.8
  • TI-2023-18861 Loftware Spectrum before 5.1 allows SSRF. CVSS 3.1HIGH 8.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences