Description
Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. Attackers with access to the update interface - typically via the unit's USB update port - can craft or modify firmware packages to execute arbitrary code as root, allowing persistent compromise of the device's integrity and deck randomization process. Physical or on-premises access remains the most likely attack path, though network-exposed or telemetry-enabled deployments could theoretically allow remote exploitation if misconfigured. The vendor confirmed that firmware updates have been issued to correct these update-chain weaknesses and that USB update access has been disabled on affected units.
INFO
Published Date :
2025-10-24T23:02:29.851Z
Last Modified :
2025-10-27T15:21:02.916Z
Source :
VulnCheck
AFFECTED PRODUCTS
The following products are affected by CVE-2025-34500 vulnerability.
| Vendors | Products |
|---|---|
| Shuffle Master |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-34500.
