Deck Mate 2: Missing Immutable Root of Trust in Hardware
CVE-2025-34502 is a high-severity missing immutable root of trust in hardware vulnerability in Deck Mate 2 from Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, with a CVSS 4.0 base score of 7.0 out of 10. It can be exploited with physical access to the device by an unauthenticated attacker, without any action from a user. The record lists version all known versions prior to 2025-10-23 as the first without the flaw, so updating Deck Mate 2 to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.21% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Deck Mate 2 to all known versions prior to 2025-10-23 or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master | Deck Mate 2 | before all known versions prior to 2025-10-23 | all known versions prior to 2025-10-23 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- PhysicalThe attacker must physically touch the device.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Attack requirements
- NoneThe attack does not depend on a particular deployment or configuration.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Confidentiality (vulnerable system)
- HighSerious loss of confidentiality on the vulnerable system.
- Integrity (vulnerable system)
- HighSerious loss of integrity on the vulnerable system.
- Availability (vulnerable system)
- HighSerious loss of availability on the vulnerable system.
- Confidentiality (other systems)
- NoneNo loss of confidentiality on systems beyond the vulnerable one.
- Integrity (other systems)
- NoneNo loss of integrity on systems beyond the vulnerable one.
- Availability (other systems)
- NoneNo loss of availability on systems beyond the vulnerable one.
Vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. Scored by CNA (vulncheck.com).
Official description
Deck Mate 2 lacks a verified secure-boot chain and runtime integrity validation for its controller and display modules. Without cryptographic boot verification, an attacker with physical access can modify or replace the bootloader, kernel, or filesystem and gain persistent code execution on reboot. This weakness allows long-term firmware tampering that survives power cycles. The vendor indicates that more recent firmware updates strengthen update-chain integrity and disable physical update ports to mitigate related attack avenues.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Missing Immutable Root of Trust in Hardware
A missing immutable root of trust in the hardware results in the ability to bypass secure boot or execute untrusted or adversarial boot code.
How developers prevent this class of flaw
- When architecting the system, the RoT should be designated for storage in a memory that does not allow further programming/writes. Note that, for components like ROM, secure patching/update features should be supported to allow authenticated and authorized updates in the field.
- During implementation and test, the RoT memory location should be demonstrated to not allow further programming/writes.
More Missing Immutable Root of Trust in Hardware vulnerabilities (CWE-1326)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Other references
Other vulnerabilities in Deck Mate 2
- 7.0 High severity
- 7.0 High severity
Recent Missing Immutable Root of Trust in Hardware vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.5 High severity
- 7.6 High severity
Spotted an error? Tell us.