CVE-2025-34501: Shuffle Master Deck Mate 2 Hard-coded Credentials & Exposed Services

Severity: high (CVSS 7.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-03 · updated 2026-10-18
Weakness: CWE-798

Description

Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet, SMB, X11) are enabled by default. If an attacker can reach these interfaces - most often through local or near-local access such as connecting to the USB or Ethernet ports beneath the table - the built-in credentials permit administrative login and full control of the system. Once authenticated, an attacker can access firmware utilities, modify controller software, and establish persistent compromise. Remote attack paths via network, cellular, or telemetry links may exist in specific configurations but generally require additional capabilities or operator error. The vendor reports that USB access has been disabled in current firmware builds.

Affected products

Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. Deck Mate 2: before all known versions prior to 2025-10-23 — fixed in all known versions prior to 2025-10-23

How to fix

Upgrade to a fixed version: Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. Deck Mate 2 all known versions prior to 2025-10-23. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-34501 or the next vulnerability affects your stack