Shuffle Master Deck Mate 2 Hard-coded Credentials & Exposed Services
Vulnerability Description
Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet, SMB, X11) are enabled by default. If an attacker can reach these interfaces - most often through local or near-local access such as connecting to the USB or Ethernet ports beneath the table - the built-in credentials permit administrative login and full control of the system. Once authenticated, an attacker can access firmware utilities, modify controller software, and establish persistent compromise. Remote attack paths via network, cellular, or telemetry links may exist in specific configurations but generally require additional capabilities or operator error. The vendor reports that USB access has been disabled in current firmware builds.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-34501
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Joseph Tartaro of IOActive
- Enrique Nissim of IOActive
- Ethan Shackelford of IOActive
References
More from Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.
View All →Affected Vendor
Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.
View all reports →