CVE-2025-34503
Deck Mate 1 executes firmware directly from an external EEPROM without verifying authenticity or integrity. An attacker with physical access can replace or reflash the EEPROM to run arbitrary code that persists across reboots. Because this design predates modern secure-boot or signed-update mechanisms, affected systems should be physically protected or retired from service. The vendor has not indicated that firmware updates are available for this legacy model.
Scoring
- Severity
- HIGH
- CVSS base score
- 7
- CVSS vector
- CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.12%
- CWE
- CWE-347, CWE-1326
- Published
- 2025-10-24
- Last modified
- 2026-07-28
Affected products
- Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. Deck Mate 1
Weakness type
Related vulnerabilities
- CVE-2023-54355 — PocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve
- CVE-2026-79970 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-56207 — Apache Impala: SAML authentication bypass via forged bearer token
- CVE-2026-87732 — An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The...
- CVE-2026-86080 — n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open
- CVE-2026-69646 — Skype for Business Spoofing Vulnerability
- CVE-2026-57098 — Microsoft Remote Desktop App for Windows Information Disclosure Vulnerability
- CVE-2026-14296 — nRF54H20: MCUBoot can be tricked to executing unauthenticated code