Altera Quartus Prime Standard/Quartus Prime Lite up to 24.1 on Windows Command Shell uncontrolled search path

Summaryinfo

A vulnerability marked as problematic has been reported in Altera Quartus Prime Standard and Quartus Prime Lite up to 24.1 on Windows. This impacts an unknown function of the component Command Shell Module. Performing a manipulation results in uncontrolled search path. This vulnerability is reported as CVE-2025-14625. The attack requires a local approach. No exploit exists.

Detailsinfo

A vulnerability classified as critical has been found in Altera Quartus Prime Standard and Quartus Prime Lite up to 24.1 on Windows. This affects an unknown code of the component Command Shell Module. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. CWE is classifying the issue as CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard on Windows (Nios II Command Shell modules), Altera Quartus Prime Lite on Windows (Nios II Command Shell modules) allows Search Order Hijacking.This issue affects Quartus Prime Standard: from 19.1 through 24.1; Quartus Prime Lite: from 19.1 through 24.1.

The advisory is shared at altera.com. This vulnerability is uniquely identified as CVE-2025-14625 since 12/12/2025. The exploitability is told to be difficult. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/07/2026). MITRE ATT&CK project uses the attack technique T1574 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-206250). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Altera

Name

• Quartus Prime Lite
• Quartus Prime Standard

Version

• 24.0
• 24.1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion