Vulnerability · Published Oct 24, 2025 · Assigned by VulnCheck

CVE-2025-34502Shuffle Master Deck Mate 2 Missing Secure Boot

High 7.0

In plain English

A high-severity security flaw in Deck Mate 2 from Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 4.0)7.0High

Exploit odds (30 days)0.2%top 89.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Deck Mate 2 lacks a verified secure-boot chain and runtime integrity validation for its controller and display modules. Without cryptographic boot verification, an attacker with physical access can modify or replace the bootloader, kernel, or filesystem and gain persistent code execution on reboot. This weakness allows long-term firmware tampering that survives power cycles. The vendor indicates that more recent firmware updates strengthen update-chain integrity and disable physical update ports to mitigate related attack avenues.

Affected products (as reported)

Vendor	Product	Versions
Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.	Deck Mate 2	0 – before all known versions prior to 2025-10-23

Weakness: CWE-1326 · Vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.ioactive.com/wp-content/uploads/2025/05/IOActive-card-shuffler-security.pdf technical-description, exploit
https://www.vulncheck.com/advisories/shuffle-master-deck-mate-2-missing-secure-boot third-party-advisory