PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-14204 Siemens CVE debrief

CVE-2019-14204 is a critical memory-corruption issue in Das U-Boot through 2019.07. The NVD description identifies a stack-based buffer overflow in the NFS reply helper function nfs_umountall_reply. The published CVSS 3.0 vector indicates a network-reachable issue with no privileges or user interaction required, and potential high impact to confidentiality, integrity, and availability.

Vendor
Siemens
Product
RUGGEDCOM ROX MX5000
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-14
Advisory published
2026-05-12
Advisory updated
2026-05-14

Who should care

Teams that deploy or maintain U-Boot in embedded devices, bootloaders, appliances, or systems that use NFS-related boot or management paths should treat this as urgent. Security owners should also care if they inventory firmware but do not routinely track bootloader versions.

Technical summary

NVD classifies the weakness as CWE-787 and lists affected U-Boot versions through 2019.07. The issue is described as a stack-based buffer overflow in the nfs_handler reply helper function nfs_umountall_reply. The CVSS vector in NVD is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a remotely reachable, low-complexity condition with no privileges or user interaction required.

Defensive priority

Critical: prioritize immediately for any exposed or widely deployed U-Boot instance, especially systems using NFS-related functionality.

Recommended defensive actions

  • Inventory devices and firmware that use U-Boot, and identify any builds at or below 2019.07.
  • Apply vendor or platform guidance from the referenced advisory sources and move to a non-vulnerable U-Boot release when available.
  • Reduce exposure of affected boot or NFS-related paths where practical until remediation is complete.
  • Validate whether embedded products ship U-Boot as part of the boot chain, even if the main OS is patched.
  • Track this issue in firmware risk management and include it in emergency update planning for customer-facing devices.

Evidence notes

The NVD record states that the issue affects Denx U-Boot through 2019.07 and describes a stack-based buffer overflow in nfs_umountall_reply. NVD also lists CWE-787 and the CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The supplied NVD references include a third-party advisory, the U-Boot GitLab project, and a Siemens CERT advisory page, which should be used for vendor-side remediation context.

Sources and references

Verified primary and authoritative sources

  • CVE-2019-14204 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2019-14204

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2019-14204 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2019-14204

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-134-16.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-577017.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-577017.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-16

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.