Shuffle Master Deck Mate 2 Insecure Update Chain
Vulnerability Description
Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. Attackers with access to the update interface - typically via the unit's USB update port - can craft or modify firmware packages to execute arbitrary code as root, allowing persistent compromise of the device's integrity and deck randomization process. Physical or on-premises access remains the most likely attack path, though network-exposed or telemetry-enabled deployments could theoretically allow remote exploitation if misconfigured. The vendor confirmed that firmware updates have been issued to correct these update-chain weaknesses and that USB update access has been disabled on affected units.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-34500
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Joseph Tartaro of IOActive
- Enrique Nissim of IOActive
- Ethan Shackelford of IOActive
References
- https://www.ioactive.com/wp-content/uploads/2025/05/IOActive-card-shuffler-security.pdf
- https://www.wired.com/story/card-shuffler-hack/
- https://www.wired.com/story/how-hacked-card-shufflers-allegedly-enabled-a-mob-fueled-poker-scam-that-rocked-the-nba/
- https://www.vulncheck.com/advisories/shuffle-master-deck-mate-2-insecure-update-chain
More from Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.
View All →Affected Vendor
Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.
View all reports →