Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master vulnerabilities
We track 4 vulnerabilities in Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 3, 2025.
Latest Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master vulnerabilities
- 7.0 High severity
Deck Mate 2: Use of Hard-coded Credentials
Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet, SMB, X11) are enabled by default. If an attacker can reach these interfaces - most often through lo
- 7.0 High severity
Deck Mate 1: Improper Verification of Cryptographic Signature
Deck Mate 1 executes firmware directly from an external EEPROM without verifying authenticity or integrity. An attacker with physical access can replace or reflash the EEPROM to run arbitrary code that persists across reboots. Because this design predates mode
- 7.0 High severity
Deck Mate 2: Missing Immutable Root of Trust in Hardware
Deck Mate 2 lacks a verified secure-boot chain and runtime integrity validation for its controller and display modules. Without cryptographic boot verification, an attacker with physical access can modify or replace the bootloader, kernel, or filesystem and ga
- 7.0 High severity
Deck Mate 2: Use of Hard-coded Cryptographic Key
Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. Attackers with access to the update