CVE-2023-37226

The vulnerability classified as CWE-287 (Missing Authentication for a Critical Function) means that specific functionality of the Loftware Spectrum application is accessible without requiring user authentication. An attacker can send a properly crafted network request directly to the vulnerable endpoint, bypassing access control mechanisms. Due to the network vector (AV:N) and the absence of user interaction requirement (UI:N) or privileges (PR:N), the attack can be conducted entirely remotely and without any prior permissions.

An attacker can gain unauthorized access to sensitive data, modify system content, and cause its unavailability, which corresponds to maximum impact on confidentiality, integrity, and availability (C:H/I:H/A:H).

Loftware Spectrum should be updated to version 4.6 HF14 or later according to the manufacturer's information available in the release notes: https://docs.loftware.com/spectrum-releasenotes/Content/Hotfix/4.6_HF14.htm

Loftware Spectrum in versions prior to 4.6 HF14