TI-2025-24526 Aliases CVE-2025-34500 GHSA-rhx6-vj26-2frq

Shuffle Master Deck Mate 2 Insecure Update Chain

LOW 30CWE-321Published 2025-10-24 · Updated 2026-07-28

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass, Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-321 and CWE-327.

Summary

Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. Attackers with access to the update interface - typically via the unit's USB update port - can craft or modify firmware packages to execute arbitrary code as root, allowing persistent compromise of the device's integrity and deck randomization process. Physical or on-premises access remains the most likely attack path, though network-exposed or telemetry-enabled deployments could theoretically allow remote exploitation if misconfigured. The vendor confirmed that firmware updates have been issued to correct these update-chain weaknesses and that USB update access has been disabled on affected units.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0015 4th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed Deck Mate 2 (Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.): all known versions prior to 2025-10-23

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.	Deck Mate 2	before all known versions prior to 2025-10-23	all known versions prior to 2025-10-23	Patch available	CNA

Deck Mate 2 VendorLight & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. Affected before all known versions prior to 2025-10-23 Fixed in all known versions prior to 2025-10-23 Patch available CNA

Remediation

Fix · CNA Deck Mate 2 (Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.) Fixed in all known versions prior to 2025-10-23

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2025-10-24
Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master Deck Mate 2 all known versions prior to 2025-10-23
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-24528 Shuffle Master Deck Mate 2 Missing Secure BootPriority LOW 32
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2025-34500
2026-10-03 Alias added: GHSA-rhx6-vj26-2frq

References

Exploit 1

https://www.ioactive.com/wp-content/uploads/2025/05/IOActive-card-shuffler-security.pdf

Other 2

TI-2025-24529 Shuffle Master Deck Mate 1 Unauthenticated EEPROM Firmware Execution CVSS 4.0HIGH 7.0
TI-2025-24528 Shuffle Master Deck Mate 2 Missing Secure Boot CVSS 4.0HIGH 7.0
TI-2025-24527 Shuffle Master Deck Mate 2 Hard-coded Credentials & Exposed Services CVSS 4.0HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences