PT-2025-43689

CVE-2025-34503

Published

2025-10-24

Updated

2025-10-25

Description by

CVSS 4.0

7.0

High

MetricsAV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Deck Mate 1 (affected versions not specified)

Description Deck Mate 1 executes firmware directly from an external EEPROM without verifying its authenticity or integrity. An attacker with physical access can replace or reflash the EEPROM to execute arbitrary code that persists across reboots. The design lacks modern secure-boot or signed-update mechanisms.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Enrique Nissim

Ethan Shackelford

Joseph Tartaro

Vendors

Affected products

Weakness enumeration

CWE-1326: Missing Immutable Root of Trust in Hardware