Is CVE-2019-14199 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-14199 being exploited in the wild.

How severe is CVE-2019-14199?

Critical severity, with a CVSS score of 9.8, published 31 July 2019.

Which products and versions are affected?

Siemens RUGGEDCOM ROX II before 2.17.1.

Is there a fix for CVE-2019-14199?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2019-14199 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2019-14199?

Check whether you run Denx U-Boot or Siemens RUGGEDCOM ROX II at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-14199: Das U-Boot integer underflow in UDP packet parsing

CVE-2019-14199 · Severity: critical · CVSS 9.8 · Published 2019-07-31

A vulnerability was found in the U-Boot bootloader, which is widely used in embedded systems and networking hardware to start the operating system. An attacker could send specially crafted network traffic to take full control of the device before the main security protections of the operating system even begin to run. This could lead to complete device compromise, data theft, or permanent disruption of the hardware.

Technologies: Denx U-Boot, Siemens RUGGEDCOM ROX II. Vendors: Denx, Siemens.

Quick answers

Is CVE-2019-14199 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-14199 being exploited in the wild.
How severe is CVE-2019-14199?: Critical severity, with a CVSS score of 9.8, published 31 July 2019.
Which products and versions are affected?: Siemens RUGGEDCOM ROX II before 2.17.1.
Is there a fix for CVE-2019-14199?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2019-14199 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2019-14199?: Check whether you run Denx U-Boot or Siemens RUGGEDCOM ROX II at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer underflow vulnerability exists in Das U-Boot through version 2019.07 within the net_process_received_packet function. When the software processes a specially crafted UDP packet, the underflow occurs during a call to the udp_packet_handler, leading to an unbounded memcpy operation. This is a classic buffer overflow scenario that can be triggered remotely over the network without authentication. A successful exploit allows an attacker to execute arbitrary code with high privileges during the boot process. Siemens has also identified this as affecting various Ruggedcom Rox II devices, recommending an update to version 2.17.1 or later.

Affected products

Das U-Boot U-Boot through 2019.07
Siemens Ruggedcom Rox II family before 2.17.1

Timeline

2019-07-31: disclosed
2019-07-31: advisory: NVD published CVE-2019-14199
2026-05-12: advisory: Siemens released SSA-577017 addressing the issue in Ruggedcom products

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.