CVE-2025-34503
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Deck Mate 1 executes firmware directly from an external EEPROM without verifying authenticity or integrity. An attacker with physical access can replace or reflash the EEPROM to run arbitrary code that persists across reboots.
Risk Assessment
Due to the lack of secure-boot or signed-update mechanisms, the device is vulnerable to persistent takeover by an attacker with physical access, potentially compromising data confidentiality and integrity.
Recommendation
Physically protect the device or retire it from service, as the vendor has not provided firmware updates for this legacy model.
Other vulnerabilities in Deck Mate 1
See all- CVE-2025-34502High
Deck Mate 2 lacks a verified secure-boot chain and runtime integrity validation for its controller and display modules. Without cryptographic boot verification, an attacker with physical access can modify or replace the bootloader, kernel, or filesystem and gain persistent code execution on reboot. This weakness allows long-term firmware tampering that survives power cycles. The vendor indicates that more recent firmware updates strengthen update-chain integrity and disable physical update ports to mitigate related attack avenues.
- CVE-2025-34500High
Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. An attacker with access to the update interface (typically via the USB update port) can craft or modify firmware packages to execute arbitrary code as root, persistently compromising the device's integrity and deck randomization process.
Original NVD description (English source)
Deck Mate 1 executes firmware directly from an external EEPROM without verifying authenticity or integrity. An attacker with physical access can replace or reflash the EEPROM to run arbitrary code that persists across reboots. Because this design predates modern secure-boot or signed-update mechanisms, affected systems should be physically protected or retired from service. The vendor has not indicated that firmware updates are available for this legacy model.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS