CVE-2022-30552: Das U-Boot buffer overflow in bootloader

CVE-2022-30552 · Severity: medium · CVSS 5.5 · Published 2022-06-08

A buffer overflow vulnerability exists in U-Boot, a widely used bootloader for embedded systems and industrial hardware. An attacker with local access to the system could exploit this flaw to cause a system crash or denial-of-service, potentially disrupting critical operations or industrial processes. This issue affects various embedded devices, including Siemens Ruggedcom networking equipment.

Technologies: Denx U-Boot, Siemens RUGGEDCOM ROX II. Vendors: Denx, Siemens.

Quick answers

Is CVE-2022-30552 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-30552 being exploited in the wild.
How severe is CVE-2022-30552?
Medium severity, with a CVSS score of 5.5, published 8 June 2022.
Which products and versions are affected?
Siemens RUGGEDCOM ROX II < V2.17.1.
Is there a fix for CVE-2022-30552?
A patch was published on 2025-05-01: Debian LTS security update released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-30552 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2022-30552?
Check whether you run Denx U-Boot or Siemens RUGGEDCOM ROX II at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A classic buffer overflow (CWE-120) exists in Das U-Boot version 2022.01. The vulnerability stems from a buffer copy operation that does not properly check the size of the input. An attacker with local access and low privileges can exploit this to trigger a crash, resulting in a denial-of-service (DoS) by impacting the availability of the bootloader. While the primary impact is availability, buffer overflows in bootloaders can sometimes be leveraged for more complex exploitation depending on the specific implementation. Patches have been made available in downstream distributions like Debian (version 2021.01+dfsg-5+deb11u1) and integrated into vendor firmware such as Siemens Ruggedcom ROX (V2.17.1).

Affected products

  • Das U-Boot U-Boot 2022.01
  • Siemens Ruggedcom Rox II family < V2.17.1

Timeline

  • 2022-06-03: advisory: Technical advisory published by NCC Group
  • 2022-06-08: disclosed: CVE published in NVD
  • 2025-05-01: patched: Debian LTS security update released
  • 2026-05-12: advisory: Siemens SSA-577017 advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.