CVE-2025-34503

Deck Mate 1 executes firmware directly from an external EEPROM without verifying authenticity or integrity. An attacker with physical access can replace or reflash the EEPROM to run arbitrary code that persists across reboots. Because this design predates modern secure-boot or signed-update mechanisms, affected systems should be physically protected or retired from service. The vendor has not indicated that firmware updates are available for this legacy model.

CVSS 4.0

7.0CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS

0.1% chance of exploitation in the next 30 days; higher than 2% of CVEs (scores of 2026-10-25)

CWEs

CWE-347, CWE-1326

Published

2025-10-24

Modified

2026-10-08

Record from

the NVD, synced 2026-10-19

References

• https://www.ioactive.com/wp-content/uploads/2025/05/IOActive-card-shuffler-security.pdf
• https://www.vulncheck.com/advisories/shuffle-master-deck-mate-1-unauthenticated-eeprom-firmware-execution

Check your stackJSON