https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 20:13:37 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-341674 EUVD-2026-341674 https://cve.radiocsirt.org/vuln/euvd-2026-341674 https://cve.radiocsirt.org/vuln/fkie_cve-2025-34500 <p>Deck Mate 2&#39;s firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. Attackers with access to the update interface - typically via the unit&#39;s USB update port - can craft or modify firmware packages to execute arbitrary code as root, allowing persistent compromise of the device&#39;s integrity and deck randomization process. Physical or on-premises access remains the most likely attack path, though network-exposed or telemetry-enabled deployments could theoretically allow remote exploitation if misconfigured. The vendor confirmed that firmware updates have been issued to correct these update-chain weaknesses and that USB update access has been disabled on affected units.</p> <p>Deck Mate 2&#39;s firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. Attackers with access to the update interface - typically via the unit&#39;s USB update port - can craft or modify firmware packages to execute arbitrary code as root, allowing persistent compromise of the device&#39;s integrity and deck randomization process. Physical or on-premises access remains the most likely attack path, though network-exposed or telemetry-enabled deployments could theoretically allow remote exploitation if misconfigured. The vendor confirmed that firmware updates have been issued to correct these update-chain weaknesses and that USB update access has been disabled on affected units.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-34500 https://cve.radiocsirt.org/vuln/ghsa-rhx6-vj26-2frq <p>Deck Mate 2&#39;s firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. Attackers with access to the update interface - typically via the unit&#39;s USB update port - can craft or modify firmware packages to execute arbitrary code as root, allowing persistent compromise of the device&#39;s integrity and deck randomization process. Physical or on-premises access remains the most likely attack path, though network-exposed or telemetry-enabled deployments could theoretically allow remote exploitation if misconfigured. The vendor confirmed that firmware updates have been issued to correct these update-chain weaknesses and that USB update access has been disabled on affected units.</p> <p>Deck Mate 2&#39;s firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. Attackers with access to the update interface - typically via the unit&#39;s USB update port - can craft or modify firmware packages to execute arbitrary code as root, allowing persistent compromise of the device&#39;s integrity and deck randomization process. Physical or on-premises access remains the most likely attack path, though network-exposed or telemetry-enabled deployments could theoretically allow remote exploitation if misconfigured. The vendor confirmed that firmware updates have been issued to correct these update-chain weaknesses and that USB update access has been disabled on affected units.</p> https://cve.radiocsirt.org/vuln/ghsa-rhx6-vj26-2frq