PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-14194 Siemens CVE debrief

CVE-2019-14194 describes a critical flaw in U-Boot through 2019.07 affecting the NFSv2 reply path. In the vulnerable flow, nfs_read_reply can call store_block after a failed length check, resulting in an unbounded memcpy. Because the issue is network-reachable and rated CVSS 9.8, it should be treated as an urgent bootloader hardening and patching priority for any device that uses U-Boot network boot or NFS-based boot logic.

Vendor
Siemens
Product
RUGGEDCOM ROX MX5000
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-14
Advisory published
2026-05-12
Advisory updated
2026-05-14

Who should care

Embedded device vendors, OEM firmware teams, bootloader maintainers, and security teams responsible for systems that ship or deploy U-Boot, especially where network boot or NFS boot is enabled.

Technical summary

The NVD record states that U-Boot through 2019.07 contains an unbounded memcpy in nfs_read_reply when calling store_block in the NFSv2 case, with a failed length check. NVD maps the weakness to CWE-787 and assigns CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a remotely reachable memory-corruption issue with high impact.

Defensive priority

Immediate

Recommended defensive actions

  • Upgrade to a U-Boot release that includes the vendor or upstream fix for CVE-2019-14194.
  • If NFS/network boot is not required, disable or remove that boot path to reduce exposure.
  • Apply downstream firmware/vendor patches to any shipped bootloader images, including board-specific forks.
  • Inventory deployed devices and build artifacts to identify U-Boot versions at or below 2019.07.
  • Restrict access to boot services and trusted management networks where network boot must remain enabled.
  • Review vendor advisories and upstream U-Boot security references for patch guidance and backport status.

Evidence notes

The debrief is based on the supplied NVD/CVE corpus: description text says the issue exists in Das U-Boot through 2019.07 and involves an unbounded memcpy with a failed length check at nfs_read_reply when calling store_block in the NFSv2 case. NVD assigns CWE-787 and CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Reference links supplied in the corpus include the CVE record, NVD detail, a Semmle advisory blog, the U-Boot repository, and a Siemens advisory page. CVE published date used here is 2019-07-31; the later NVD modification date is noted only as record context.

Sources and references

Verified primary and authoritative sources

  • CVE-2019-14194 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2019-14194

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2019-14194 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2019-14194

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-134-16.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-577017.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-577017.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-16

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.