PT-2025-43688 · Unknown · Deck Mate 2

Enrique Nissim + 2 · Publicado 2025-10-24 · Atualizado 2025-10-24 · CVE-2025-34502

Positive Technologies (AI Summary)

CVSS v4.0

7.0

Alta

Vetor base

AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Deck Mate 2 (affected versions not specified)

Description The Deck Mate 2 device does not have a verified secure-boot chain or runtime integrity validation for its controller and display modules. Without cryptographic boot verification, an attacker with physical access can modify or replace the bootloader, kernel, or filesystem, leading to persistent code execution upon reboot. This allows for long-term firmware tampering that persists even after power cycles. The vendor has indicated that recent firmware updates improve update-chain integrity and disable physical update ports to reduce potential attack vectors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-1326

Identificadores relacionados

CVE-2025-34502

Produtos afetados

Deck Mate 2

Referências · 6

• 🔥 https://ioactive.com/wp-content/uploads/2025/05/IOActive-card-shuffler-security.pdf · Exploit
• https://twitter.com/CVEnew/status/1981865676563165490 · Publicação no Twitter
• https://t.me/CVEtracker/35722 · Publicação no Telegram
• https://t.me/cveNotify/140321 · Publicação no Telegram
• https://vulncheck.com/advisories/shuffle-master-deck-mate-2-missing-secure-boot · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-34502 · Nota de Segurança