CVE-2025-34501: Deck Mate 2 0 to before all known versions prior to 2025-10-23

Affected technology

Deck Mate 2 · 0 to before all known versions prior to 2025-10-23
Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc.

Component: Root shell credentials and web UI auth, SSH/HTTP/Telnet/SMB/X11 exposure

Attack conditions (Vendor/CNA, CVSS 4.0): Physical access · No privileges required · No user interaction required

What an attacker can do

If an attacker can reach these interfaces - most often through local or near-local access such as connecting to the USB or Ethernet ports beneath the table - the built-in credentials permit administrative login and full control of the system. Vendor/CNA’s CVSS 4.0 assessment (base score 7.0/10) rates confidentiality, integrity and availability impact as high.