CVE-2023-37233 is a high severity authenticated XXE flaw (CVSS 8.8) in Loftware Spectrum, label and print management software. Versions before Spectrum 4.6 HF14 are affected, so install hotfix 14 for 4.6 or later after testing, and limit who has accounts.
What's affected
- Product: Loftware Spectrum, enterprise label and print software.
- Affected versions: before 4.6 HF14, per the record.
- Fixed version: 4.6 HF14. The Loftware release notes for that hotfix, dated July 2023, say it includes important security updates but list no CVE IDs.
- Severity: High, CVSS 8.8, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
- Exploited in the wild: the record's CISA KEV flag is false.
The CODE WHITE list is the research firm's public record of several Spectrum issues, published in August 2024. The record for this CVE was published in September 2024. The researcher listing shows it fixed in Spectrum 4.6 HF14.
How to check if you're exposed
Check the Spectrum version and hotfix level in the product's own administration and about pages, or in your install records. There is no package manager command that applies to every deployment.
If you run 4.6 and the installed hotfix is lower than HF14, you are in the affected range. XXE needs an authenticated user, so also review who holds accounts on the system.
What to do now
- Confirm your Spectrum version and hotfix level.
- Install Spectrum 4.6 HF14 or a later release. Test in a non-production environment first, since the hotfix bundles several earlier fixes.
- Limit who has authenticated access, and remove accounts that are no longer needed.
- Restrict network access to the Spectrum server to the clients and printers that need it.
- Re-check the version after the update.
Why it matters
The weakness class is CWE-611. XXE happens when an XML parser is allowed to resolve external entities from the input it reads. A crafted document can then make the server read local files or contact internal systems. Disabling external entity resolution in the parser is the usual defence.
The record says an authenticated user is needed, which narrows who can reach it, but print and label systems often have many accounts across sites.
Safeguard can help with the inventory side of this work. The free in-browser dependency scan at gold.safeguard.sh/scan checks the packages in a manifest against known CVEs, and the Gold directory keeps a page per CVE and per weakness class so you can see related issues in one place. Reachability analysis then helps you separate a package that is merely present from one your code actually calls.
Quick check
Which hotfix fixes it?
Spectrum 4.6 HF14, per the record and the CODE WHITE list. The Loftware release notes for HF14 mention security updates without naming CVEs.
Does an attacker need an account?
Yes. The record describes an authenticated XXE attack.
Sources
- NVD record for CVE-2023-37233
- Safeguard Gold page
- CODE WHITE public vulnerability list
- Loftware Spectrum 4.6 HF14 release notes
Last reviewed: 19 October 2026.
