TI-2025-24527 Aliases CVE-2025-34501 GHSA-434j-26h4-7637

Shuffle Master Deck Mate 2 Hard-coded Credentials & Exposed Services

LOW 32CWE-798Published 2025-11-03 · Updated 2026-07-28

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet, SMB, X11) are enabled by default. If an attacker can reach these interfaces - most often through local or near-local access such as connecting to the USB or Ethernet ports beneath the table - the built-in credentials permit administrative login and full control of the system. Once authenticated, an attacker can access firmware utilities, modify controller software, and establish persistent compromise. Remote attack paths via network, cellular, or telemetry links may exist in specific configurations but generally require additional capabilities or operator error. The vendor reports that USB access has been disabled in current firmware builds.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00196 9th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed Deck Mate 2 (Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.): all known versions prior to 2025-10-23

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.	Deck Mate 2	before all known versions prior to 2025-10-23	all known versions prior to 2025-10-23	Patch available	CNA

Deck Mate 2 VendorLight & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. Affected before all known versions prior to 2025-10-23 Fixed in all known versions prior to 2025-10-23 Patch available CNA

Remediation

Fix · CNA Deck Mate 2 (Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.) Fixed in all known versions prior to 2025-10-23

Timeline

2026-10-02 Threatist record created from CVE-2025-34501
2026-10-03 Alias added: GHSA-434j-26h4-7637

References

Exploit 1

https://www.ioactive.com/wp-content/uploads/2025/05/IOActive-card-shuffler-security.pdf

TI-2025-24529 Shuffle Master Deck Mate 1 Unauthenticated EEPROM Firmware Execution CVSS 4.0HIGH 7.0
TI-2025-24528 Shuffle Master Deck Mate 2 Missing Secure Boot CVSS 4.0HIGH 7.0
TI-2025-24526 Shuffle Master Deck Mate 2 Insecure Update Chain CVSS 4.0HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences