PT-2025-43688 · Unknown · Deck Mate 2

Enrique Nissim + 2 · Published 2025-10-24 · Updated 2025-10-24 · CVE-2025-34502

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Deck Mate 2 (affected versions not specified)

Description The Deck Mate 2 device does not have a verified secure-boot chain or runtime integrity validation for its controller and display modules. Without cryptographic boot verification, an attacker with physical access can modify or replace the bootloader, kernel, or filesystem, leading to persistent code execution upon reboot. This allows for long-term firmware tampering that persists even after power cycles. The vendor has indicated that recent firmware updates improve update-chain integrity and disable physical update ports to reduce potential attack vectors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-1326

Related Identifiers

CVE-2025-34502

Affected Products

Deck Mate 2

References · 6

• 🔥 https://ioactive.com/wp-content/uploads/2025/05/IOActive-card-shuffler-security.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34502 · Security Note
• https://twitter.com/CVEnew/status/1981865676563165490 · Twitter Post
• https://t.me/CVEtracker/35722 · Telegram Post
• https://t.me/cveNotify/140321 · Telegram Post
• https://vulncheck.com/advisories/shuffle-master-deck-mate-2-missing-secure-boot · Note