Vulnerability in Light & Wonder, Inc. / Shfl Entertainment, Shuffle Master, Deck Mate 2
CVE-2025-34500
Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. Attackers with access to the update interface - typically via the unit's USB update port - can craft or modify firmware packages to execute arbitrary code as root, allowing persistent compromise of the device's integrity and deck randomization process. Physical or on-premises access remains the most likely attack path, though network-exposed or telemetry-enabled deployments could theoretically allow remote exploitation if misconfigured. The vendor confirmed that firmware updates have been issued to correct these update-chain weaknesses and that USB update access has been disabled on affected units.
Published · last modified .
EPSS exploit prediction
EPSS: 0.002 (3.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 4th percentile — 3.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.002 · change: +0.000
Affected products
Weakness classification (CWE)
References
- www.ioactive.com/wp-content/uploads/2025/05/IOActive-card-shuffler-security.pdf (technical-description, exploit)
- www.wired.com/story/card-shuffler-hack/ (media-coverage)
- www.wired.com/story/how-hacked-card-shufflers-allegedly-enabled-a-mob-fueled-po… (media-coverage)
- www.vulncheck.com/advisories/shuffle-master-deck-mate-2-insecure-update-chain (third-party-advisory)