CVE-2025-34500: Shuffle Master Deck Mate 2 Insecure Update Chain

Severity: high (CVSS 7.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-24 · updated 2026-10-08
Weakness: CWE-321

Description

Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. Attackers with access to the update interface - typically via the unit's USB update port - can craft or modify firmware packages to execute arbitrary code as root, allowing persistent compromise of the device's integrity and deck randomization process. Physical or on-premises access remains the most likely attack path, though network-exposed or telemetry-enabled deployments could theoretically allow remote exploitation if misconfigured. The vendor confirmed that firmware updates have been issued to correct these update-chain weaknesses and that USB update access has been disabled on affected units.

Affected products

Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. Deck Mate 2: before all known versions prior to 2025-10-23 — fixed in all known versions prior to 2025-10-23

How to fix

Upgrade to a fixed version: Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. Deck Mate 2 all known versions prior to 2025-10-23. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-34500 or the next vulnerability affects your stack