PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-14192 Siemens CVE debrief

CVE-2019-14192 is a critical memory-corruption flaw in Das U-Boot’s network packet handling. According to the NVD record, a UDP packet parsed through nc_input_packet can drive an integer underflow in net_process_received_packet, leading to an unbounded memcpy. The CVSS 3.0 vector is network-reachable, requires no privileges or user interaction, and is scored 9.8. Systems using affected U-Boot releases through 2019.07 should be treated as high priority for review and remediation.

Vendor
Siemens
Product
RUGGEDCOM ROX MX5000
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-14
Advisory published
2026-05-12
Advisory updated
2026-05-14

Who should care

Embedded device vendors, firmware maintainers, and operators of products that use U-Boot for boot-time networking, provisioning, or network boot paths should care most. This includes downstream integrators that ship custom U-Boot forks or reuse vendor trees without regularly backporting fixes.

Technical summary

The supplied NVD record identifies two weakness classes, CWE-191 (integer underflow) and CWE-787 (out-of-bounds write). The flaw is described as an unbounded memcpy during UDP packet parsing, triggered by an integer underflow in net_process_received_packet while processing nc_input_packet. NVD lists affected U-Boot versions through 2019.07 and assigns CVSS 3.0 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a remotely reachable issue with no authentication or user interaction required.

Defensive priority

Immediate. This is a critical, remotely reachable memory-corruption issue in a bootloader component, so affected deployments should be inventoried and remediated as soon as possible.

Recommended defensive actions

  • Inventory all products, firmware images, and downstream forks that include U-Boot and confirm whether they are at or below 2019.07.
  • Apply the upstream or vendor-provided fix from official U-Boot guidance, or upgrade to a remediated release.
  • Restrict exposure of boot-time network services and provisioning paths to trusted networks only, especially where UDP-based boot traffic is possible.
  • Backport the fix into any custom downstream tree and re-test packet-length validation around the affected parsing path.
  • Track vendor advisories and NVD updates for this CVE to confirm remediation status across all deployed product lines.

Evidence notes

Evidence is limited to the supplied NVD and linked reference corpus. The NVD record was published on 2019-07-31 and modified on 2026-05-12. NVD lists affected CPE coverage for denx:u-boot through version 2019.07, with weaknesses CWE-191 and CWE-787 and CVSS 3.0 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The record also cites third-party and project references, including a Semmle advisory, the U-Boot GitLab project, and a Siemens CERT advisory reference.

Sources and references

Verified primary and authoritative sources

  • CVE-2019-14192 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2019-14192

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2019-14192 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2019-14192

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-134-16.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-577017.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-577017.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-16

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.