# CVE-2022-2347: Denx U-Boot infinite recursion in DOS partition table parsing Source: https://junglewise.ai/threats/cve-2019-13103-denx-u-boot-infinite-recursion-in-dos-partition-table-parsing Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2019-07-29. Updated: 2026-05-15 License: CC BY 4.0 with a link back CVE-2022-2347 · Severity: high · CVSS 7.1 · Published 2019-07-29 Siemens Ruggedcom ROX, an operating system for industrial routers and switches, is affected by multiple third-party software vulnerabilities. These flaws could allow an attacker to disrupt industrial network operations, gain unauthorized access, or execute malicious code. Siemens has released version 2.17.1 to address these issues and recommends immediate updates to protect critical infrastructure environments. Technologies: [Siemens RUGGEDCOM ROX II](https://junglewise.ai/threats/technologies/ruggedcom-rox-ii), [Siemens RUGGEDCOM ROX MX5000](https://junglewise.ai/threats/technologies/ruggedcom-rox-mx5000), [Siemens RUGGEDCOM ROX MX5000RE](https://junglewise.ai/threats/technologies/ruggedcom-rox-mx5000re), [Siemens RUGGEDCOM ROX RX1400](https://junglewise.ai/threats/technologies/ruggedcom-rox-rx1400), [Siemens RUGGEDCOM ROX RX1500](https://junglewise.ai/threats/technologies/ruggedcom-rox-rx1500), [Siemens RUGGEDCOM ROX RX1501](https://junglewise.ai/threats/technologies/ruggedcom-rox-rx1501), [Siemens RUGGEDCOM ROX RX1510](https://junglewise.ai/threats/technologies/ruggedcom-rox-rx1510), [Siemens RUGGEDCOM ROX RX1511](https://junglewise.ai/threats/technologies/ruggedcom-rox-rx1511), [Siemens RUGGEDCOM ROX RX1512](https://junglewise.ai/threats/technologies/ruggedcom-rox-rx1512), [Siemens RUGGEDCOM ROX RX1524](https://junglewise.ai/threats/technologies/ruggedcom-rox-rx1524), [Siemens RUGGEDCOM ROX RX1536](https://junglewise.ai/threats/technologies/ruggedcom-rox-rx1536), [Siemens RUGGEDCOM ROX RX5000](https://junglewise.ai/threats/technologies/ruggedcom-rox-rx5000). Vendors: [Siemens](https://junglewise.ai/threats/vendors/siemens). ## Quick answers **Is CVE-2022-2347 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-2347 being exploited in the wild. **How severe is CVE-2022-2347?** High severity, with a CVSS score of 7.1, published 29 July 2019. **Which products and versions are affected?** Siemens RUGGEDCOM ROX II before V2.17.1; Siemens RUGGEDCOM ROX MX5000 < 2.17.1; Siemens RUGGEDCOM ROX MX5000RE < 2.17.1; Siemens RUGGEDCOM ROX RX1400 < 2.17.1; and 8 more. **Is there a fix for CVE-2022-2347?** A patch was published on 2026-05-14: Siemens released ROX v2.17.1 to address vulnerabilities Junglewise finds every place you run it, drafts the upgrade and applies it once you approve. **How is CVE-2022-2347 attacked?** It is attacked over the network, in an operating system. **Am I affected by CVE-2022-2347?** Check whether you run Siemens RUGGEDCOM ROX II, Siemens RUGGEDCOM ROX MX5000, Siemens RUGGEDCOM ROX MX5000RE or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## Technical details Siemens Ruggedcom ROX operating system contains multiple vulnerabilities inherited from third-party components, including issues in U-Boot, OpenSSL, and other libraries. The vulnerabilities span several classes such as heap-based buffer overflows, out-of-bounds reads/writes, integer underflows, and use-after-free conditions. Many of these flaws are reachable over the network without authentication, potentially allowing for remote code execution (RCE) or a complete denial of service (DoS) of the industrial networking equipment. The most severe issues carry a CVSS score of 9.8. Users are advised to upgrade to ROX v2.17.1 or later. ## Affected products - Siemens RUGGEDCOM ROX MX5000 < 2.17.1 - Siemens RUGGEDCOM ROX MX5000RE < 2.17.1 - Siemens RUGGEDCOM ROX RX1400 < 2.17.1 - Siemens RUGGEDCOM ROX RX1500 < 2.17.1 - Siemens RUGGEDCOM ROX RX1501 < 2.17.1 - Siemens RUGGEDCOM ROX RX1510 < 2.17.1 - Siemens RUGGEDCOM ROX RX1511 < 2.17.1 - Siemens RUGGEDCOM ROX RX1512 < 2.17.1 - Siemens RUGGEDCOM ROX RX1524 < 2.17.1 - Siemens RUGGEDCOM ROX RX1536 < 2.17.1 - Siemens RUGGEDCOM ROX RX5000 < 2.17.1 ## Identifiers - CVE-2022-2347 - CVE-2019-14200 - CVE-2022-30790 - CVE-2025-49794 - CVE-2020-10648 - CVE-2025-46836 - CVE-2023-27043 - CVE-2019-14202 - CVE-2019-14198 - CVE-2019-14199 - CVE-2025-6020 - CVE-2019-14192 - CVE-2025-9714 - CVE-2025-49796 - CVE-2025-0395 - CVE-2024-57256 - CVE-2022-34835 - CVE-2019-14194 - CVE-2019-14193 - CVE-2024-22365 - CVE-2024-57258 - CVE-2019-14195 - CVE-2019-13104 - CVE-2019-13106 - CVE-2024-3447 - CVE-2019-13103 - CVE-2025-7425 - CVE-2019-14201 - CVE-2019-14197 - CVE-2023-3019 - CVE-2019-14196 - CVE-2022-30552 - CVE-2025-3576 - CVE-2019-14204 - CVE-2019-14203 ## Timeline - 2026-05-14: advisory: CISA Advisory ICSA-26-134-16 published - 2026-05-14: patched: Siemens released ROX v2.17.1 to address vulnerabilities ## References - [https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-16](https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-16) ## Related threats - [Siemens RUGGEDCOM ROX command injection in Scheduler Web UI](https://junglewise.ai/threats/cve-2025-40949-siemens-ruggedcom-rox-command-injection-in-scheduler-web-ui) - [Siemens RUGGEDCOM ROX argument injection in JSON-RPC interface](https://junglewise.ai/threats/cve-2025-40948-siemens-ruggedcom-rox-argument-injection-in-json-rpc-interface) - [Siemens RUGGEDCOM ROX command injection in feature key installation](https://junglewise.ai/threats/cve-2025-40947-siemens-ruggedcom-rox-command-injection-in-feature-key) - [A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All…](https://junglewise.ai/threats/cve-2024-56840-a-vulnerability-has-been-identified-in-ruggedcom-rox-mx5000-all) - [A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All…](https://junglewise.ai/threats/cve-2024-56839-a-vulnerability-has-been-identified-in-ruggedcom-rox-mx5000-all)