The Patching Friars' AlmanacA calendar of CVE saints

Patron of November 3

Deck Mate 2Holy card for deck-mate-2, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 Deck Mate 2 CHARTAE APERTAE
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint Deck Mate 2, Who Shuffled With the Cards Face Up

Patron of casino card shufflers, hard-coded credentials identical for everyone, and cheats with a USB cable.

Life

In November 2025 a vulnerability became public in the Deck Mate 2 card shuffler, used at poker tables: the device shipped with fixed root and web-interface credentials, identical across every unit, and SSH, HTTP, Telnet, SMB and X11 enabled by default. Whoever reached the USB or Ethernet ports beneath the table could log in and modify the firmware; back in 2023 IOActive had shown this lets you read the deck order from the internal camera. The vendor says USB access has been disabled in recent builds.

Prayer

O Saint Deck Mate 2, who shuffles the cards and reveals the deck, let no machine be born with the same password as all the others. Amen.

How to celebrate

Celebrated by updating the firmware, changing every default credential and keeping the ports under the table out of guests' reach.

Technical record

Disclosed on
November 3 2025
CVE
CVE-2025-34501
CVSS
7.0
Product
Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. · Deck Mate 2

Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet, SMB, X11) are enabled by default. If an attacker can reach these interfaces - most often through local or near-local access such as connecting to the USB or Ethernet ports beneath the table - the built-in credentials permit administrative login and full control of the system. Once authenticated, an attacker can access firmware utilities, modify controller software, and establish persistent compromise. Remote attack paths via network, cellular, or telemetry links may exist in specific configurations but generally require additional capabilities or operator error. The vendor reports that USB access has been disabled in current firmware builds.

Sources: nvd.nist.gov

Canonized by Pope CitrixBleed II

Related saints

Same year: 2025

📅 Add to your calendar

Saints:Google CalendarApple, Outlook and others (.ics)

Observances (feasts, scourges and miracles):Google CalendarApple, Outlook and others (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.