CVE-2023-37234 is a critical severity weakness (CVSS 9.8) in Loftware Spectrum through version 4.6 that has an unprotected JMX registry. The researcher listing says there is no code fix and a manual change is required, so follow vendor guidance and restrict network access.
What's affected
- Product: Loftware Spectrum, enterprise label and print software.
- Affected versions: through 4.6, per the record.
- Fixed version: none as a code release. The CODE WHITE public vulnerability list marks this CVE as not fixed with a manual change required. It does not spell out the steps in the text I could retrieve, so ask Loftware for the guidance.
- Severity: Critical, CVSS 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
- Exploited in the wild: the record's CISA KEV flag is false.
The CODE WHITE list is the research firm's public record of several Spectrum issues, published in August 2024. The record for this CVE was published in September 2024. The vendor listing says this one will not be fixed and that a manual change is required.
How to check if you're exposed
Check the Spectrum version and hotfix level in the product's own administration and about pages, or in your install records. There is no package manager command that applies to every deployment.
Because the weakness is about a management registry, check which network segments can reach the Spectrum server and its Java management ports.
What to do now
- Confirm your Spectrum version. Versions through 4.6 are in scope.
- Contact Loftware for the manual change that applies to your deployment, and ask whether upgrading to a newer major release changes your exposure.
- Restrict network access to the Spectrum server so only the clients, printers and administrators that need it can connect.
- Keep management ports off untrusted networks and monitor connections to them.
- Record the decision and the compensating controls, since no patch will arrive for this item.
Why it matters
The weakness class is CWE-284. JMX is the Java management interface. An unprotected registry means a remote client may be able to talk to management beans without proving who it is. The record rates this critical at 9.8: network reachable, no privileges, no user interaction, and high impact on all three areas.
Since the listing says no code fix is planned, network controls and the vendor's manual change are the defence.
Safeguard can help with the inventory side of this work. The free in-browser dependency scan at gold.safeguard.sh/scan checks the packages in a manifest against known CVEs, and the Gold directory keeps a page per CVE and per weakness class so you can see related issues in one place. Reachability analysis then helps you separate a package that is merely present from one your code actually calls.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Will Loftware release a patch?
The CODE WHITE list marks this item as not fixed and requiring a manual change. Ask Loftware for current guidance, because the listing does not describe the steps.
What reduces risk in the meantime?
Limit network access to the server to only the clients and administrators that need it, and apply any manual change the vendor provides.
Sources
Last reviewed: 19 October 2026.
