CVE-2025-34503 describes an improper verification of cryptographic signature vulnerability (CWE-347) in Light & Wonder, Inc.'s Deck Mate 1 device. The device executes firmware directly from an external EEPROM without validating its authenticity or integrity, enabling an attacker with physical access to replace or reflash the EEPROM with malicious code. This code can persist across device reboots. The vulnerability stems from the absence of secure boot or signed firmware update mechanisms in this legacy hardware. No firmware updates or patches are available from the vendor to address this issue.

An attacker with physical access can replace or reflash the external EEPROM to execute arbitrary code on the device. This malicious code can persist across reboots, potentially compromising device functionality or security. The vulnerability does not require user interaction or privileges but does require physical access. There are no known exploits in the wild. The lack of cryptographic verification means the device is susceptible to firmware tampering attacks.

No official patches or firmware updates are available from the vendor for this legacy model. Because the vulnerability requires physical access, the primary mitigation is to ensure strong physical security controls to prevent unauthorized access to the device. Alternatively, affected devices should be retired from service to eliminate risk. There are no software-based mitigations due to the device's design limitations.