Vulnerability · Published Oct 24, 2025 · Assigned by VulnCheck

CVE-2025-34503Shuffle Master Deck Mate 1 Unauthenticated EEPROM Firmware Execution

High 7.0

In plain English

A high-severity security flaw in Deck Mate 1 from Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 4.0)7.0High

Exploit odds (30 days)0.1%top 97.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Deck Mate 1 executes firmware directly from an external EEPROM without verifying authenticity or integrity. An attacker with physical access can replace or reflash the EEPROM to run arbitrary code that persists across reboots. Because this design predates modern secure-boot or signed-update mechanisms, affected systems should be physically protected or retired from service. The vendor has not indicated that firmware updates are available for this legacy model.

Affected products (as reported)

Vendor	Product	Versions
Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.	Deck Mate 1	0 – before unknown

Weakness: CWE-347, CWE-1326 · Vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.ioactive.com/wp-content/uploads/2025/05/IOActive-card-shuffler-security.pdf technical-description, exploit
https://www.vulncheck.com/advisories/shuffle-master-deck-mate-1-unauthenticated-eeprom-firmware-execution third-party-advisory