CVE-2025-14605

Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro on Windows (System Console modules) allows Search Order Hijacking.This issue affects Quartus Prime Pro: from 17.0 through 25.1.1.

CVSS v3 6.7 MEDIUM

6.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.altera.com/security/security-advisory/asa-0004	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:intel:quartus_prime:*:*:*:*:pro:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

17 Jun 2026, 08:36

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de Elemento de Ruta de Búsqueda No Controlado en Altera Quartus Prime Pro en Windows (módulos de la Consola del Sistema) permite el Secuestro del Orden de Búsqueda. Este problema afecta a Quartus Prime Pro: desde la versión 17.0 hasta la 25.1.1.

12 Jan 2026, 15:16

Type	Values Removed	Values Added
First Time		Intel quartus Prime Microsoft windows Microsoft Intel
CPE		cpe:2.3:o:microsoft:windows:-:::::::* cpe:2.3:a:intel:quartus_prime:::::pro:::*
References	~~() https://www.altera.com/security/security-advisory/asa-0004 -~~	() https://www.altera.com/security/security-advisory/asa-0004 - Vendor Advisory

07 Jan 2026, 02:02

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-07 02:02

Updated : 2026-06-17 08:36

NVD link : CVE-2025-14605

Mitre link : CVE-2025-14605

CVE.ORG link : CVE-2025-14605

JSON object : View

Products Affected

microsoft

windows

intel

quartus_prime

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2025-14605", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14605", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-07T16:55:19.083370Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "04c0172e-9735-4a9d-a92a-fe01fa863447", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}], "cvssMetricV40": [{"type": "Secondary", "source": "04c0172e-9735-4a9d-a92a-fe01fa863447", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "04c0172e-9735-4a9d-a92a-fe01fa863447", "affectedData": [{"vendor": "Altera", "modules": ["System Console"], "product": "Quartus Prime Pro", "versions": [{"status": "affected", "version": "17.0", "versionType": "custom", "lessThanOrEqual": "25.1.1"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}]}], "published": "2026-01-07T02:02:59.913", "references": [{"url": "https://www.altera.com/security/security-advisory/asa-0004", "tags": ["Vendor Advisory"], "source": "04c0172e-9735-4a9d-a92a-fe01fa863447"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "04c0172e-9735-4a9d-a92a-fe01fa863447", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro on Windows (System Console modules) allows Search Order Hijacking.This issue affects Quartus Prime Pro: from 17.0 through 25.1.1."}, {"lang": "es", "value": "Una vulnerabilidad de Elemento de Ruta de B\u00fasqueda No Controlado en Altera Quartus Prime Pro en Windows (m\u00f3dulos de la Consola del Sistema) permite el Secuestro del Orden de B\u00fasqueda. Este problema afecta a Quartus Prime Pro: desde la versi\u00f3n 17.0 hasta la 25.1.1."}], "lastModified": "2026-06-17T08:36:15.050", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:intel:quartus_prime:*:*:*:*:pro:*:*:*", "vulnerable": true, "matchCriteriaId": "3DA2B70E-9364-4349-8107-E0A888CB9878", "versionEndExcluding": "25.1.1", "versionStartIncluding": "17.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "04c0172e-9735-4a9d-a92a-fe01fa863447"}