CVE-2025-34500 (CNNVD-202510-3399)
中文标题:
Light & Wonder Deck Mate 安全漏洞
英文标题:
Shuffle Master Deck Mate 2 Insecure Update Chain
漏洞描述
中文描述:
Light & Wonder Deck Mate是英国Light & Wonder公司的一款自动发牌设备。 Light & Wonder Deck Mate存在安全漏洞，该漏洞源于固件更新机制未验证加密签名并使用硬编码AES密钥，可能导致执行任意代码。
英文描述:
Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. Attackers with access to the update interface - typically via the unit's USB update port - can craft or modify firmware packages to execute arbitrary code as root, allowing persistent compromise of the device's integrity and deck randomization process. Physical or on-premises access remains the most likely attack path, though network-exposed or telemetry-enabled deployments could theoretically allow remote exploitation if misconfigured. The vendor confirmed that firmware updates have been issued to correct these update-chain weaknesses and that USB update access has been disabled on affected units.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. | Deck Mate 2 | - | < all known versions prior to 2025-10-23 | - |
cpe:2.3:a:light_&_wonder,_inc.___shfl_entertainment,_inc.___shuffle_master,_inc.:deck_mate_2:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
4.0 (cna)
HIGHCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-34500 |
2025-11-11 15:23:17 | 2025-11-11 07:40:26 |
| NVD | nvd_CVE-2025-34500 |
2025-11-11 15:01:07 | 2025-11-11 07:48:15 |
| CNNVD | cnnvd_CNNVD-202510-3399 |
2025-11-11 15:13:00 | 2025-11-11 08:00:19 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202510-3399
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']