« Volver al listado

CVE-2025-14599

Estado: AnalizadaMedia (5.4)—

Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard

Installer (SFX)

on Windows, Altera Quartus Prime Lite

Installer (SFX)

on Windows allows Search Order Hijacking.This issue affects Quartus Prime Standard: from 23.1 through 24.1; Quartus Prime Lite: from 23.1 through 24.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Intel — Quartus Prime

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-14599",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-14599",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-06T21:46:59.180090Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "04c0172e-9735-4a9d-a92a-fe01fa863447",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "04c0172e-9735-4a9d-a92a-fe01fa863447",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 5.4,
          "Automatable": "NOT_DEFINED",
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "ACTIVE",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "04c0172e-9735-4a9d-a92a-fe01fa863447",
      "affectedData": [
        {
          "vendor": "Altera",
          "modules": [
            "Installer"
          ],
          "product": "Quartus Prime Standard",
          "versions": [
            {
              "status": "affected",
              "version": "23.1",
              "versionType": "custom",
              "lessThanOrEqual": "24.1"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Altera",
          "modules": [
            "Installer"
          ],
          "product": "Quartus Prime Lite",
          "versions": [
            {
              "status": "affected",
              "version": "23.1",
              "versionType": "custom",
              "lessThanOrEqual": "24.1"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-01-07T02:02:59.743",
  "references": [
    {
      "url": "https://www.altera.com/security/security-advisory/asa-0005",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "04c0172e-9735-4a9d-a92a-fe01fa863447"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "04c0172e-9735-4a9d-a92a-fe01fa863447",
      "description": [
        {
          "lang": "en",
          "value": "CWE-427"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard \n\nInstaller (SFX)\n\non Windows, Altera Quartus Prime Lite \n\nInstaller (SFX)\n\n on Windows allows Search Order Hijacking.This issue affects Quartus Prime Standard: from 23.1 through 24.1; Quartus Prime Lite: from 23.1 through 24.1."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Elemento de Ruta de Búsqueda No Controlado en Altera Quartus Prime Standard\n\nInstalador (SFX)\n\nen Windows, Altera Quartus Prime Lite\n\nInstalador (SFX)\n\nen Windows permite el Secuestro de Orden de Búsqueda. Este problema afecta a Quartus Prime Standard: desde 23.1 hasta 24.1; Quartus Prime Lite: desde 23.1 hasta 24.1."
    }
  ],
  "lastModified": "2026-06-17T08:36:14.800",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:intel:quartus_prime:*:*:*:*:lite:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C682DFC-7352-43BD-9138-341634CDE948",
              "versionEndExcluding": "25.1",
              "versionStartIncluding": "23.1"
            },
            {
              "criteria": "cpe:2.3:a:intel:quartus_prime:*:*:*:*:standard:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "297C4320-AA94-4418-9B31-8072877B7F55",
              "versionEndExcluding": "25.1",
              "versionStartIncluding": "23.1"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "04c0172e-9735-4a9d-a92a-fe01fa863447"
}