Altera Quartus Prime Standard System Console Utility DLL Planting Vulnerability

A DLL planting vulnerability has been identified in the System Console Utility for Windows, part of the Altera Quartus Prime Standard Edition Design Software. This vulnerability arises when the Quartus Prime Programmer and Tools package is installed independently, rather than as part of a complete Quartus Prime Standard Edition installation. The issue does not affect the Linux version of the software.

Impact

Exploitation of this vulnerability could lead to unauthorized DLLs being loaded by the System Console Utility, potentially allowing for arbitrary code execution.

Remediation

Users can upgrade to Quartus Prime Standard Edition version 24.1 or later. Alternatively, if version 24.1 or later is not available, the full Quartus Standard version can be installed to use the System Console Utility. For users of the original Design Space Explorer, the obsolete qcmd.bat file can be deleted to mitigate the vulnerability.