CVE-2025-34502 identifies a vulnerability in Light & Wonder, Inc.'s Deck Mate 2 product where the hardware lacks an immutable root of trust. Specifically, the device does not implement a verified secure-boot chain or runtime integrity checks for its controller and display modules. This deficiency permits attackers with physical access to alter or replace bootloader, kernel, or filesystem components, resulting in persistent firmware tampering that survives reboots. The vendor notes that more recent firmware updates enhance the integrity of the update process and disable physical update ports to reduce attack vectors.

An attacker with physical access can achieve persistent code execution by modifying or replacing firmware components on the Deck Mate 2 device. This undermines device integrity and trustworthiness, potentially allowing long-term unauthorized control over the device's operation. The vulnerability does not require user interaction or privileges and has a high impact on confidentiality, integrity, and availability of the device firmware.

No official patch or firmware update is explicitly provided in the available data. However, the vendor indicates that more recent firmware versions strengthen update-chain integrity and disable physical update ports to mitigate the issue. Users should verify and apply the latest firmware updates from the vendor that address these concerns. Physical access controls should also be enforced to limit attacker opportunities.