CVE-2025-34500

{"id": "CVE-2025-34500", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-34500", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-27T15:20:40.299784Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.0, "Automatable": "NOT_DEFINED", "attackVector": "PHYSICAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.", "modules": ["Update/decryption utility and package verification"], "product": "Deck Mate 2", "versions": [{"status": "affected", "version": "0", "lessThan": "all known versions prior to 2025-10-23", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2025-10-24T23:15:46.620", "references": [{"url": "https://www.ioactive.com/wp-content/uploads/2025/05/IOActive-card-shuffler-security.pdf", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/shuffle-master-deck-mate-2-insecure-update-chain", "source": "disclosure@vulncheck.com"}, {"url": "https://www.wired.com/story/card-shuffler-hack/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.wired.com/story/how-hacked-card-shufflers-allegedly-enabled-a-mob-fueled-poker-scam-that-rocked-the-nba/", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-321"}, {"lang": "en", "value": "CWE-327"}, {"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. Attackers with access to the update interface - typically via the unit's USB update port - can craft or modify firmware packages to execute arbitrary code as root, allowing persistent compromise of the device's integrity and deck randomization process. Physical or on-premises access remains the most likely attack path, though network-exposed or telemetry-enabled deployments could theoretically allow remote exploitation if misconfigured. The vendor confirmed that firmware updates have been issued to correct these update-chain weaknesses and that USB update access has been disabled on affected units."}, {"lang": "es", "value": "El mecanismo de actualizaci\u00f3n de firmware de Deck Mate 2 acepta paquetes sin verificaci\u00f3n de firma criptogr\u00e1fica, los cifra con una \u00fanica clave AES codificada compartida entre dispositivos y utiliza un HMAC truncado para la validaci\u00f3n de integridad. Los atacantes con acceso a la interfaz de actualizaci\u00f3n - t\u00edpicamente a trav\u00e9s del puerto de actualizaci\u00f3n USB de la unidad - pueden crear o modificar paquetes de firmware para ejecutar c\u00f3digo arbitrario como root, lo que permite el compromiso persistente de la integridad del dispositivo y del proceso de aleatorizaci\u00f3n de mazos. El acceso f\u00edsico o in situ sigue siendo la ruta de ataque m\u00e1s probable, aunque las implementaciones expuestas a la red o con telemetr\u00eda habilitada podr\u00edan te\u00f3ricamente permitir la explotaci\u00f3n remota si est\u00e1n mal configuradas. El proveedor confirm\u00f3 que se han emitido actualizaciones de firmware para corregir estas debilidades en la cadena de actualizaci\u00f3n y que el acceso de actualizaci\u00f3n USB se ha deshabilitado en las unidades afectadas."}], "lastModified": "2026-10-08T11:10:00.250", "sourceIdentifier": "disclosure@vulncheck.com"}