CVE-2025-34501 describes a vulnerability in Deck Mate 2 devices from Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. The devices contain hard-coded static credentials for root and web UI access, while multiple management services are enabled by default. This allows an attacker with local or near-local access (e.g., USB or Ethernet ports under the table) to authenticate with administrative privileges, access firmware utilities, modify controller software, and establish persistent control. Although remote attack vectors via network, cellular, or telemetry links may exist in certain configurations, they generally require additional attacker capabilities or operator errors. The vendor reports that USB access has been disabled in current firmware builds to mitigate one local attack vector.

An attacker with local or near-local access can use hard-coded credentials to gain full administrative control over the device, potentially modifying firmware and maintaining persistent compromise. This compromises the confidentiality, integrity, and availability of the system. Remote exploitation is less straightforward and depends on specific configurations and additional attacker capabilities.

No official patch or firmware update is currently documented. The vendor has disabled USB access in current firmware builds, reducing one local attack vector. Users should verify firmware versions and apply any vendor updates when available. Physical access controls should be enforced to prevent unauthorized local or near-local access to device ports. Monitor vendor advisories for official fixes or further mitigation guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.