LiveActive security incident?Get immediate response
CVE Record

CVE-2019-14199: An issue was discovered in Das U-Boot through 2019.07.

An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet integer underflow during an *udp_packet_handler call.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This CVE describes a memory corruption flaw in Das U-Boot through 2019.07 when it parses UDP packets. Business risk depends on whether devices use vulnerable U-Boot builds and expose bootloader network handling. The provided sources do not include CVSS, confirmed exploitation, or a universal vendor fix.

Executive priority

Treat this as an exposure-discovery item rather than a confirmed emergency. It becomes higher priority for network-reachable embedded or industrial devices where bootloader access could affect recovery, availability, or firmware integrity.

Technical view

The issue is an integer underflow in net_process_received_packet during a udp_packet_handler call, leading to an unbounded memcpy while parsing a UDP packet. It affects Das U-Boot through 2019.07 per the CVE description. Product-level impact is not enumerated in the supplied CVE data.

Likely exposure

Likely exposure is embedded, OT, or appliance firmware using Das U-Boot through 2019.07, especially where network boot or bootloader UDP processing is reachable. The supplied affected-product data is n/a, so asset-level confirmation is required.

Exploitation context

The bundle does not show CISA KEV listing or cited evidence of active exploitation. The vulnerability is network-packet parsing in a bootloader context, but the supplied evidence is insufficient to state real-world exploitation or reliable remote code execution conditions.

Researcher notes

Key gaps are absent CVSS, missing CWE data, n/a affected products, and no supplied patch identifier. Validate against source trees, vendor advisories, and firmware versions before declaring exposure. Avoid assuming all U-Boot-based products are vulnerable.

Mitigation direction

  • Identify devices and firmware images using Das U-Boot through 2019.07.
  • Check U-Boot and device-vendor advisories for fixed firmware or backported patches.
  • Prioritize Siemens-exposed assets only if the linked Siemens advisory confirms applicability.
  • Restrict bootloader network access to trusted management or provisioning networks.
  • Disable unnecessary network boot behavior where vendor-supported.

Validation and detection

  • Inventory firmware SBOMs, boot logs, or vendor documentation for U-Boot version evidence.
  • Confirm whether network boot or UDP handling is enabled during bootloader stages.
  • Review vendor advisories for exact affected models and remediation status.
  • Verify segmentation prevents untrusted hosts reaching bootloader network services.
  • Document unknown-version devices for vendor follow-up or compensating controls.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2019-14199 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.