CVE-2025-34500

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-34500", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2025-04-15T19:15:22.611Z", "datePublished": "2025-10-24T23:02:29.851Z", "dateUpdated": "2026-07-28T01:48:05.051Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["Update/decryption utility and package verification"], "product": "Deck Mate 2", "vendor": "Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.", "versions": [{"lessThan": "all known versions prior to 2025-10-23", "status": "affected", "version": "0", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:british_airways:entertainment_system:*:*:*:*:*:*:*:*", "versionEndExcluding": "all"}]}]}], "credits": [{"lang": "en", "type": "finder", "value": "Joseph Tartaro of IOActive"}, {"lang": "en", "type": "finder", "value": "Enrique Nissim of IOActive"}, {"lang": "en", "type": "finder", "value": "Ethan Shackelford of IOActive"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. Attackers with access to the update interface - typically via the unit's USB update port - can craft or modify firmware packages to execute arbitrary code as root, allowing persistent compromise of the device's integrity and deck randomization process. Physical or on-premises access remains the most likely attack path, though network-exposed or telemetry-enabled deployments could theoretically allow remote exploitation if misconfigured. The vendor confirmed that firmware updates have been issued to correct these update-chain weaknesses and that USB update access has been disabled on affected units.<br>"}], "value": "Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. Attackers with access to the update interface - typically via the unit's USB update port - can craft or modify firmware packages to execute arbitrary code as root, allowing persistent compromise of the device's integrity and deck randomization process. Physical or on-premises access remains the most likely attack path, though network-exposed or telemetry-enabled deployments could theoretically allow remote exploitation if misconfigured. The vendor confirmed that firmware updates have been issued to correct these update-chain weaknesses and that USB update access has been disabled on affected units."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "PHYSICAL", "baseScore": 7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-321", "description": "CWE-321 Use of Hard-coded Cryptographic Key", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-327", "description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-347", "description": "CWE-347 Improper Verification of Cryptographic Signature", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-28T01:48:05.051Z"}, "references": [{"tags": ["technical-description", "exploit"], "url": "https://www.ioactive.com/wp-content/uploads/2025/05/IOActive-card-shuffler-security.pdf"}, {"tags": ["media-coverage"], "url": "https://www.wired.com/story/card-shuffler-hack/"}, {"tags": ["media-coverage"], "url": "https://www.wired.com/story/how-hacked-card-shufflers-allegedly-enabled-a-mob-fueled-poker-scam-that-rocked-the-nba/"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/shuffle-master-deck-mate-2-insecure-update-chain"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Light &amp; Wonder reports that it has deployed firmware updates addressing the update-chain weaknesses IOActive described (including fixes to the cryptographic integrity checks) and has disabled the USB update port on affected Deck Mate 2 units.</span><br>"}], "value": "Light & Wonder reports that it has deployed firmware updates addressing the update-chain weaknesses IOActive described (including fixes to the cryptographic integrity checks) and has disabled the USB update port on affected Deck Mate 2 units."}], "source": {"discovery": "UNKNOWN"}, "title": "Shuffle Master Deck Mate 2 Insecure Update Chain", "x_generator": {"engine": "Vulnogram 0.4.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-27T15:20:40.299784Z", "id": "CVE-2025-34500", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T15:21:02.916Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-34500", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-27T15:20:40.299784Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T15:20:50.511Z"}}], "cna": {"title": "Shuffle Master Deck Mate 2 Insecure Update Chain", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Joseph Tartaro of IOActive"}, {"lang": "en", "type": "finder", "value": "Enrique Nissim of IOActive"}, {"lang": "en", "type": "finder", "value": "Ethan Shackelford of IOActive"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7, "Automatable": "NOT_DEFINED", "attackVector": "PHYSICAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.", "modules": ["Update/decryption utility and package verification"], "product": "Deck Mate 2", "versions": [{"status": "affected", "version": "0", "lessThan": "all known versions prior to 2025-10-23", "versionType": "custom"}], "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "Light & Wonder reports that it has deployed firmware updates addressing the update-chain weaknesses IOActive described (including fixes to the cryptographic integrity checks) and has disabled the USB update port on affected Deck Mate 2 units.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Light &amp; Wonder reports that it has deployed firmware updates addressing the update-chain weaknesses IOActive described (including fixes to the cryptographic integrity checks) and has disabled the USB update port on affected Deck Mate 2 units.</span><br>", "base64": false}]}], "references": [{"url": "https://www.ioactive.com/wp-content/uploads/2025/05/IOActive-card-shuffler-security.pdf", "tags": ["technical-description", "exploit"]}, {"url": "https://www.wired.com/story/card-shuffler-hack/", "tags": ["media-coverage"]}, {"url": "https://www.wired.com/story/how-hacked-card-shufflers-allegedly-enabled-a-mob-fueled-poker-scam-that-rocked-the-nba/", "tags": ["media-coverage"]}, {"url": "https://www.vulncheck.com/advisories/shuffle-master-deck-mate-2-insecure-update-chain", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.4.0"}, "descriptions": [{"lang": "en", "value": "Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. Attackers with access to the update interface - typically via the unit's USB update port - can craft or modify firmware packages to execute arbitrary code as root, allowing persistent compromise of the device's integrity and deck randomization process. Physical or on-premises access remains the most likely attack path, though network-exposed or telemetry-enabled deployments could theoretically allow remote exploitation if misconfigured. The vendor confirmed that firmware updates have been issued to correct these update-chain weaknesses and that USB update access has been disabled on affected units.", "supportingMedia": [{"type": "text/html", "value": "Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. Attackers with access to the update interface - typically via the unit's USB update port - can craft or modify firmware packages to execute arbitrary code as root, allowing persistent compromise of the device's integrity and deck randomization process. Physical or on-premises access remains the most likely attack path, though network-exposed or telemetry-enabled deployments could theoretically allow remote exploitation if misconfigured. The vendor confirmed that firmware updates have been issued to correct these update-chain weaknesses and that USB update access has been disabled on affected units.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-321", "description": "CWE-321 Use of Hard-coded Cryptographic Key"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-327", "description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347 Improper Verification of Cryptographic Signature"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:british_airways:entertainment_system:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "all"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-28T01:48:05.051Z"}}}, "cveMetadata": {"cveId": "CVE-2025-34500", "state": "PUBLISHED", "dateUpdated": "2026-07-28T01:48:05.051Z", "dateReserved": "2025-04-15T19:15:22.611Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2025-10-24T23:02:29.851Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "modules": ["Update/decryption utility and package verification"], "product": "Deck Mate 2", "vendor": "Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.", "versions": [{"lessThan": "all known versions prior to 2025-10-23", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. Attackers with access to the update interface - typically via the unit's USB update port - can craft or modify firmware packages to execute arbitrary code as root, allowing persistent compromise of the device's integrity and deck randomization process. Physical or on-premises access remains the most likely attack path, though network-exposed or telemetry-enabled deployments could theoretically allow remote exploitation if misconfigured. The vendor confirmed that firmware updates have been issued to correct these update-chain weaknesses and that USB update access has been disabled on affected units."}, {"lang": "es", "value": "El mecanismo de actualizaci\u00f3n de firmware de Deck Mate 2 acepta paquetes sin verificaci\u00f3n de firma criptogr\u00e1fica, los cifra con una \u00fanica clave AES codificada compartida entre dispositivos y utiliza un HMAC truncado para la validaci\u00f3n de integridad. Los atacantes con acceso a la interfaz de actualizaci\u00f3n - t\u00edpicamente a trav\u00e9s del puerto de actualizaci\u00f3n USB de la unidad - pueden crear o modificar paquetes de firmware para ejecutar c\u00f3digo arbitrario como root, lo que permite el compromiso persistente de la integridad del dispositivo y del proceso de aleatorizaci\u00f3n de mazos. El acceso f\u00edsico o in situ sigue siendo la ruta de ataque m\u00e1s probable, aunque las implementaciones expuestas a la red o con telemetr\u00eda habilitada podr\u00edan te\u00f3ricamente permitir la explotaci\u00f3n remota si est\u00e1n mal configuradas. El proveedor confirm\u00f3 que se han emitido actualizaciones de firmware para corregir estas debilidades en la cadena de actualizaci\u00f3n y que el acceso de actualizaci\u00f3n USB se ha deshabilitado en las unidades afectadas."}], "id": "CVE-2025-34500", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "PHYSICAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-34500", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-27T15:20:40.299784Z", "version": "2.0.3"}}]}, "published": "2025-10-24T23:15:46.620", "references": [{"source": "disclosure@vulncheck.com", "url": "https://www.ioactive.com/wp-content/uploads/2025/05/IOActive-card-shuffler-security.pdf"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/shuffle-master-deck-mate-2-insecure-update-chain"}, {"source": "disclosure@vulncheck.com", "url": "https://www.wired.com/story/card-shuffler-hack/"}, {"source": "disclosure@vulncheck.com", "url": "https://www.wired.com/story/how-hacked-card-shufflers-allegedly-enabled-a-mob-fueled-poker-scam-that-rocked-the-nba/"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-321"}, {"lang": "en", "value": "CWE-327"}, {"lang": "en", "value": "CWE-347"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"created": "2025-10-27T22:10:27.201485+00:00", "updated": "2025-10-27T22:10:27.201510+00:00", "vendors": ["shuffle_master", "shuffle_master$PRODUCT$deck_mate_2"]}