CVE-2025-34500

Name of the Vulnerable Software and Affected Versions Deck Mate 2 (affected versions not specified)

Description The firmware update mechanism for Deck Mate 2 does not verify cryptographic signatures on update packages. Updates are encrypted using a single, hard-coded AES key shared across all devices and employ a truncated HMAC for integrity validation. This allows attackers with access to the update interface, typically through the USB port, to create or modify firmware packages to execute arbitrary code as root. This could lead to a persistent compromise of the device's integrity and the randomization process. Physical access or on-premises network access is the most likely attack vector, though remote exploitation is theoretically possible with misconfigured network or telemetry deployments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.