Hard-Coded Credentials in Deck Mate 2 by Shuffle Master

CVE-2025-34501

What is CVE-2025-34501?

Deck Mate 2 from Shuffle Master contains hard-coded credentials for both root and web user interfaces, enabling unauthorized access to the system. Several management services—including SSH, HTTP, Telnet, SMB, and X11—are enabled by default, increasing the attack surface. If an attacker gains local or nearby access, they can leverage these credentials for administrative login, leading to full system control. After authentication, the attacker can manipulate firmware utilities and compromise the controller software, potentially establishing long-term access. Although recent firmware updates have disabled USB access, risks remain, particularly if configurations allow remote access through networks or other interfaces.

References