CVE-2025-13663

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13663", "assignerOrgId": "04c0172e-9735-4a9d-a92a-fe01fa863447", "state": "PUBLISHED", "assignerShortName": "Altera", "dateReserved": "2025-11-25T16:21:46.226Z", "datePublished": "2025-12-11T20:35:24.735Z", "dateUpdated": "2025-12-11T21:03:49.282Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Installer"], "platforms": ["Windows"], "product": "Quartus Prime Pro", "vendor": "Altera", "versions": [{"lessThanOrEqual": "24.3.1", "status": "affected", "version": "17.0", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:altera:quartus_prime_pro:*:*:windows:*:*:*:*:*", "versionEndIncluding": "24.3.1", "versionStartIncluding": "17.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Under certain circumstances, the Quartus Prime Pro Installer for Windows does not check the permissions of the Quartus target installation directory if the target installation directory already exists.</span>"}], "value": "Under certain circumstances, the Quartus Prime Pro Installer for Windows does not check the permissions of the Quartus target installation directory if the target installation directory already exists."}], "impacts": [{"capecId": "CAPEC-642", "descriptions": [{"lang": "en", "value": "CAPEC-642 Replace Binaries"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 5.4, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-279", "description": "CWE-279: Incorrect Execution-Assigned Permissions", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "04c0172e-9735-4a9d-a92a-fe01fa863447", "shortName": "Altera", "dateUpdated": "2025-12-11T20:35:24.735Z"}, "references": [{"url": "https://www.altera.com/security/security-advisory/asa-0001"}], "source": {"discovery": "EXTERNAL"}, "title": "Quartus Prime Pro Edition Installer Advisory", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-11T21:02:36.053025Z", "id": "CVE-2025-13663", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-11T21:03:49.282Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13663", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-11T21:02:36.053025Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-11T21:03:39.042Z"}}], "cna": {"title": "Quartus Prime Pro Edition Installer Advisory", "source": {"discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-642", "descriptions": [{"lang": "en", "value": "CAPEC-642 Replace Binaries"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Altera", "modules": ["Installer"], "product": "Quartus Prime Pro", "versions": [{"status": "affected", "version": "17.0", "versionType": "custom", "lessThanOrEqual": "24.3.1"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.altera.com/security/security-advisory/asa-0001"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Under certain circumstances, the Quartus Prime Pro Installer for Windows does not check the permissions of the Quartus target installation directory if the target installation directory already exists.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Under certain circumstances, the Quartus Prime Pro Installer for Windows does not check the permissions of the Quartus target installation directory if the target installation directory already exists.</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-279", "description": "CWE-279: Incorrect Execution-Assigned Permissions"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:altera:quartus_prime_pro:*:*:windows:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "24.3.1", "versionStartIncluding": "17.0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "04c0172e-9735-4a9d-a92a-fe01fa863447", "shortName": "Altera", "dateUpdated": "2025-12-11T20:35:24.735Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13663", "state": "PUBLISHED", "dateUpdated": "2025-12-11T21:03:49.282Z", "dateReserved": "2025-11-25T16:21:46.226Z", "assignerOrgId": "04c0172e-9735-4a9d-a92a-fe01fa863447", "datePublished": "2025-12-11T20:35:24.735Z", "assignerShortName": "Altera"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Installer"], "platforms": ["Windows"], "product": "Quartus Prime Pro", "vendor": "Altera", "versions": [{"lessThanOrEqual": "24.3.1", "status": "affected", "version": "17.0", "versionType": "custom"}]}], "source": "04c0172e-9735-4a9d-a92a-fe01fa863447"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:intel:quartus_prime:*:*:*:*:pro:*:*:*", "matchCriteriaId": "465646C1-E706-4FAE-945B-45AAC9013F2A", "versionEndExcluding": "25.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Under certain circumstances, the Quartus Prime Pro Installer for Windows does not check the permissions of the Quartus target installation directory if the target installation directory already exists."}, {"lang": "es", "value": "Bajo ciertas circunstancias, el instalador Quartus Prime Pro para Windows no verifica los permisos del directorio de instalaci\u00f3n de destino de Quartus si el directorio de instalaci\u00f3n de destino ya existe."}], "id": "CVE-2025-13663", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "04c0172e-9735-4a9d-a92a-fe01fa863447", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "04c0172e-9735-4a9d-a92a-fe01fa863447", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13663", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-11T21:02:36.053025Z", "version": "2.0.3"}}]}, "published": "2025-12-11T21:15:46.307", "references": [{"source": "04c0172e-9735-4a9d-a92a-fe01fa863447", "tags": ["Vendor Advisory"], "url": "https://www.altera.com/security/security-advisory/asa-0001"}], "sourceIdentifier": "04c0172e-9735-4a9d-a92a-fe01fa863447", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-279"}], "source": "04c0172e-9735-4a9d-a92a-fe01fa863447", "type": "Secondary"}]}

{}

{}