CVE-2023-37232 is a high severity weakness (CVSS 7.5) in Loftware Spectrum through version 4.6 that exposes sensitive information in logs to an unauthorized actor. The researcher listing says there is no code fix and a manual change is required, so follow vendor guidance and restrict network access.
What's affected
- Product: Loftware Spectrum, enterprise label and print software.
- Affected versions: through 4.6, per the record.
- Fixed version: none as a code release. The CODE WHITE public vulnerability list marks this CVE as not fixed with a manual change required. It does not spell out the steps in the text I could retrieve, so ask Loftware for the guidance.
- Severity: High, CVSS 7.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
- Exploited in the wild: the record's CISA KEV flag is false.
The CODE WHITE list is the research firm's public record of several Spectrum issues, published in August 2024. The record for this CVE was published in September 2024. The vendor listing says this one will not be fixed and that a manual change is required.
How to check if you're exposed
Check the Spectrum version and hotfix level in the product's own administration and about pages, or in your install records. There is no package manager command that applies to every deployment.
Because the weakness is about logs, also look at who can read the log files and whether log content is exported to other systems.
What to do now
- Confirm your Spectrum version. Versions through 4.6 are in scope.
- Contact Loftware for the manual change that applies to your deployment, and ask whether upgrading to a newer major release changes your exposure.
- Restrict network access to the Spectrum server so only the clients, printers and administrators that need it can connect.
- Restrict read access to Spectrum logs, and keep them out of widely shared locations.
- Record the decision and the compensating controls, since no patch will arrive for this item.
Why it matters
The weakness class is CWE-200. Logs often capture more than the people who wrote them intended, including request details, identifiers and sometimes credentials. When logs are readable by someone who should not see them, a low-effort information leak can feed a later attack.
The record rates the confidentiality impact as high with no integrity or availability impact. That is why the score is 7.5 even though nothing is modified.
Safeguard can help with the inventory side of this work. The free in-browser dependency scan at gold.safeguard.sh/scan checks the packages in a manifest against known CVEs, and the Gold directory keeps a page per CVE and per weakness class so you can see related issues in one place. Reachability analysis then helps you separate a package that is merely present from one your code actually calls.
Quick check
Will Loftware release a patch?
The CODE WHITE list marks this item as not fixed and requiring a manual change. Ask Loftware for current guidance, because the listing does not describe the steps.
What reduces risk in the meantime?
Limit network access to the server to only the clients and administrators that need it, and apply any manual change the vendor provides.
Sources
Last reviewed: 19 October 2026.
