PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-14196 Siemens CVE debrief

CVE-2019-14196 is a critical memory corruption vulnerability in Das U-Boot affecting versions through 2019.07. The issue is described as an unbounded memcpy after a failed length check in nfs_lookup_reply, which maps to CWE-787 (out-of-bounds write). Because the CVSS vector is network-exploitable with no privileges or user interaction and with high confidentiality, integrity, and availability impact, this should be treated as an urgent firmware-risk issue for embedded systems that use U-Boot and NFS-related boot paths.

Vendor
Siemens
Product
RUGGEDCOM ROX MX5000
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-14
Advisory published
2026-05-12
Advisory updated
2026-05-14

Who should care

Embedded device vendors, firmware and bootloader maintainers, OEMs, industrial control and appliance teams, and security teams responsible for products that ship U-Boot or depend on NFS boot flows.

Technical summary

NVD describes the flaw as an unbounded memcpy in nfs_lookup_reply following a failed length check, affecting Denx U-Boot through 2019.07. The vulnerability is categorized as CWE-787 and scored CVSS 3.0 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The affected CPE range in the record ends at version 2019.07 inclusive.

Defensive priority

Critical. The combination of network attackability, no authentication, and potential full impact on confidentiality, integrity, and availability makes this a high-priority firmware remediation item.

Recommended defensive actions

  • Upgrade U-Boot to a vendor-fixed release newer than 2019.07, or backport the upstream/vendor patch if upgrading is not immediately possible.
  • Inventory products and images that include U-Boot, especially those that use NFS boot or related network boot features.
  • Reduce exposure of boot services and management networks so U-Boot-based network boot paths are not reachable from untrusted segments.
  • Validate firmware build pipelines to ensure affected bootloader versions are not reintroduced into new device images.
  • If immediate remediation is delayed, document compensating controls and track affected devices until the fix is deployed.

Evidence notes

The vulnerability description, affected version range, CWE mapping, and CVSS data come from the NVD CVE record for CVE-2019-14196. The record cites third-party advisory and upstream project references, including a Semmle blog post and the U-Boot GitLab project, plus downstream references from Debian LTS and Siemens CERT.

Sources and references

Verified primary and authoritative sources

  • CVE-2019-14196 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2019-14196

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2019-14196 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2019-14196

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-134-16.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-577017.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-577017.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-16

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.