Read the docs
TI-2025-24528 Aliases CVE-2025-34502GHSA-3xvc-wfvf-2p2f

Shuffle Master Deck Mate 2 Missing Secure Boot

Priority LOW 32CWE-1326Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Deck Mate 2 lacks a verified secure-boot chain and runtime integrity validation for its controller and display modules. Without cryptographic boot verification, an attacker with physical access can modify or replace the bootloader, kernel, or filesystem and gain persistent code execution on reboot. This weakness allows long-term firmware tampering that survives power cycles. The vendor indicates that more recent firmware updates strengthen update-chain integrity and disable physical update ports to mitigate related attack avenues.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00206 10th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Deck Mate 2 (Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.): all known versions prior to 2025-10-23

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.Deck Mate 2before all known versions prior to 2025-10-23all known versions prior to 2025-10-23Patch availableCNA

Remediation

  • Fix · CNA Deck Mate 2 (Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.) Fixed in all known versions prior to 2025-10-23

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master Deck Mate 2 all known versions prior to 2025-10-23

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2025-24526 Shuffle Master Deck Mate 2 Insecure Update ChainPriority LOW 30
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34502
  2. 2026-10-03 Alias added: GHSA-3xvc-wfvf-2p2f

References

Exploit 1

  • TI-2025-24529 Shuffle Master Deck Mate 1 Unauthenticated EEPROM Firmware Execution CVSS 4.0HIGH 7.0
  • TI-2025-24527 Shuffle Master Deck Mate 2 Hard-coded Credentials & Exposed Services CVSS 4.0HIGH 7.0
  • TI-2025-24526 Shuffle Master Deck Mate 2 Insecure Update Chain CVSS 4.0HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences