# CVE-2019-14194: Das U-Boot stack overflow in nfs_read_reply

Source: https://junglewise.ai/threats/cve-2019-14194-das-u-boot-stack-overflow-in-nfs-read-reply  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-07-31. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2019-14194 · Severity: critical · CVSS 9.8 · Published 2019-07-31

A vulnerability exists in the U-Boot bootloader, which is widely used in embedded systems and industrial hardware like Siemens Ruggedcom devices. An attacker could exploit this flaw to gain full control over the device during its startup process. This could lead to complete system compromise, data theft, or permanent disruption of industrial operations.

Technologies: [Denx U-Boot](https://junglewise.ai/threats/technologies/u-boot), [Siemens ROX II](https://junglewise.ai/threats/technologies/rox-ii). Vendors: [Denx](https://junglewise.ai/threats/vendors/denx), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2019-14194 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-14194 being exploited in the wild.

**How severe is CVE-2019-14194?** Critical severity, with a CVSS score of 9.8, published 31 July 2019.

**Which products and versions are affected?** Siemens ROX II before V2.17.1.

**Is there a fix for CVE-2019-14194?** A patch was published on 2026-05-12: Siemens released SSA-577017 for Ruggedcom Rox II devices Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-14194 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2019-14194?** Check whether you run Denx U-Boot or Siemens ROX II at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow (CWE-787) exists in Das U-Boot through version 2019.07. The vulnerability is located in the 'nfs_read_reply' function when calling 'store_block' during NFSv2 operations. It is caused by an unbounded 'memcpy' operation that lacks a proper length check on the incoming network packet. A remote attacker on the same network can exploit this by sending a malicious NFS reply to a device attempting to boot over the network, leading to arbitrary code execution with bootloader privileges. Siemens has confirmed this affects several Ruggedcom Rox II industrial devices, which have been patched in version 2.17.1.

## Affected products

- Das U-Boot U-Boot through 2019.07
- Siemens Corproation Ruggedcom Rox II family before V2.17.1

## Timeline

- 2019-07-31: disclosed
- 2019-07-31: advisory: NVD published CVE-2019-14194
- 2026-05-12: patched: Siemens released SSA-577017 for Ruggedcom Rox II devices

## References

- [https://blog.semmle.com/uboot-rce-nfs-vulnerability/](https://blog.semmle.com/uboot-rce-nfs-vulnerability/)
- [https://gitlab.com/u-boot/u-boot](https://gitlab.com/u-boot/u-boot)
- [https://cert-portal.siemens.com/productcert/html/ssa-577017.html](https://cert-portal.siemens.com/productcert/html/ssa-577017.html)

## Related threats

- [Denx U-Boot integer overflow in ext4fs_get_bgdtable](https://junglewise.ai/threats/cve-2025-70293-denx-u-boot-integer-overflow-in-ext4fs-get-bgdtable)
- [Denx U-Boot integer overflow in ZFS filesystem support](https://junglewise.ai/threats/cve-2025-70290-denx-u-boot-integer-overflow-in-zfs-filesystem-support)
- [Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and…](https://junglewise.ai/threats/cve-2025-24857-improper-access-control-for-volatile-memory-containing-boot-code)
- [GNOME libxml2 stack overflow in XPath evaluation](https://junglewise.ai/threats/cve-2025-9714-gnome-libxml2-stack-overflow-in-xpath-evaluation)
- [Das U-Boot integer overflows in memory allocator](https://junglewise.ai/threats/cve-2024-57258-das-u-boot-integer-overflows-in-memory-allocator)