PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-14202 Siemens CVE debrief

CVE-2019-14202 is a critical memory-safety flaw in Das U-Boot through 2019.07. NVD describes it as a stack-based buffer overflow in the nfs_handler reply helper function nfs_readlink_reply. The CVSS 3.0 vector indicates a network-reachable issue with no privileges or user interaction required and high confidentiality, integrity, and availability impact, so affected firmware should be treated as urgent to assess and update.

Vendor
Siemens
Product
RUGGEDCOM ROX MX5000
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-14
Advisory published
2026-05-12
Advisory updated
2026-05-14

Who should care

Embedded device vendors, firmware maintainers, OEMs, integrators, and operators of systems that ship or depend on affected U-Boot builds through 2019.07 should prioritize this. It is especially important wherever NFS-related U-Boot functionality is present in deployed images or boot paths.

Technical summary

The NVD record maps this issue to CWE-787 and lists affected denx:u-boot versions through and including 2019.07. The vulnerable code path is described as a stack-based buffer overflow in the nfs_readlink_reply helper used by the NFS handler reply logic. The published CVSS vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which reflects an easily reachable network attack surface with severe impact potential.

Defensive priority

Immediate. Treat as a high-priority firmware remediation item for any product or image that includes an affected U-Boot version.

Recommended defensive actions

  • Inventory all products, images, and build pipelines that include U-Boot and confirm whether any deployment is at or below 2019.07.
  • Upgrade to a vendor-fixed or upstream-patched U-Boot release newer than the affected range.
  • If immediate upgrading is not possible, reduce exposure of any reachable NFS-related U-Boot functionality and isolate affected devices on trusted networks.
  • Validate downstream firmware builds and vendor forks, since embedded products may carry backported or customized U-Boot code.
  • Track the linked NVD and vendor advisories for remediation guidance and downstream patch availability.

Evidence notes

The debrief is based on the supplied official CVE/NVD metadata: publication date 2019-07-31, last modified date 2026-05-12, CVSS 9.8, weakness CWE-787, and the affected CPE range ending in U-Boot 2019.07. The record also lists third-party and vendor references including a Semmle advisory, the U-Boot GitLab repository, and a Siemens CERT advisory.

Sources and references

Verified primary and authoritative sources

  • CVE-2019-14202 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2019-14202

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2019-14202 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2019-14202

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-134-16.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-577017.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-577017.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-16

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.