TI-2025-24529 Aliases CVE-2025-34503 GHSA-4v5m-7xcr-cg68

Shuffle Master Deck Mate 1 Unauthenticated EEPROM Firmware Execution

LOW 32CWE-1326Published 2025-10-24 · Updated 2026-07-28

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-347.

Summary

Deck Mate 1 executes firmware directly from an external EEPROM without verifying authenticity or integrity. An attacker with physical access can replace or reflash the EEPROM to run arbitrary code that persists across reboots. Because this design predates modern secure-boot or signed-update mechanisms, affected systems should be physically protected or retired from service. The vendor has not indicated that firmware updates are available for this legacy model.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00131 2nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed Deck Mate 1 (Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.): unknown

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.	Deck Mate 1	before unknown	unknown	Patch available	CNA

Deck Mate 1 VendorLight & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. Affected before unknown Fixed in unknown Patch available CNA

Remediation

Fix · CNA Deck Mate 1 (Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.) Fixed in unknown

Timeline

2026-10-02 Threatist record created from CVE-2025-34503
2026-10-03 Alias added: GHSA-4v5m-7xcr-cg68

References

Exploit 1

https://www.ioactive.com/wp-content/uploads/2025/05/IOActive-card-shuffler-security.pdf

TI-2025-24528 Shuffle Master Deck Mate 2 Missing Secure Boot CVSS 4.0HIGH 7.0
TI-2025-24527 Shuffle Master Deck Mate 2 Hard-coded Credentials & Exposed Services CVSS 4.0HIGH 7.0
TI-2025-24526 Shuffle Master Deck Mate 2 Insecure Update Chain CVSS 4.0HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences