TI-2025-24529 CVE-2025-34503 · GHSA-4v5m-7xcr-cg68
Shuffle Master Deck Mate 1 Unauthenticated EEPROM Firmware Execution
Priority LOW 32
Deck Mate 1 executes firmware directly from an external EEPROM without verifying authenticity or integrity.
Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.
Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. records in CISA KEVNo Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. vulnerabilities are listed in CISA KEV.
Records
4 records
TI-2025-24528 CVE-2025-34502 · GHSA-3xvc-wfvf-2p2f
Shuffle Master Deck Mate 2 Missing Secure Boot
Priority LOW 32
Deck Mate 2 lacks a verified secure-boot chain and runtime integrity validation for its controller and display modules.
TI-2025-24527 CVE-2025-34501 · GHSA-434j-26h4-7637
Shuffle Master Deck Mate 2 Hard-coded Credentials & Exposed Services
Priority LOW 32
Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet, SMB, X11) are enabled by default.
TI-2025-24526 CVE-2025-34500 · GHSA-rhx6-vj26-2frq
Shuffle Master Deck Mate 2 Insecure Update Chain
Priority LOW 30
Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validat…