CVE-2025-34501
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Deck Mate 2 ships with static, hard-coded credentials for the root shell and web UI, while multiple management services (SSH, HTTP, Telnet, SMB, X11) are enabled by default. An attacker with local or near-local access (e.g., via USB or Ethernet ports) can log in administratively and take full control of the system.
Risk Assessment
Someone with physical or near-local access can gain full administrative control of the device, modify controller software, and establish persistent compromise.
Recommendation
Change default credentials, disable unused management services, and update firmware to a build with USB access disabled.
Other vulnerabilities in Deck Mate 2
See all- CVE-2025-34503High
Deck Mate 1 executes firmware directly from an external EEPROM without verifying authenticity or integrity. An attacker with physical access can replace or reflash the EEPROM to run arbitrary code that persists across reboots.
- CVE-2025-34502High
Deck Mate 2 lacks a verified secure-boot chain and runtime integrity validation for its controller and display modules. Without cryptographic boot verification, an attacker with physical access can modify or replace the bootloader, kernel, or filesystem and gain persistent code execution on reboot. This weakness allows long-term firmware tampering that survives power cycles. The vendor indicates that more recent firmware updates strengthen update-chain integrity and disable physical update ports to mitigate related attack avenues.
- CVE-2025-34500High
Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. An attacker with access to the update interface (typically via the USB update port) can craft or modify firmware packages to execute arbitrary code as root, persistently compromising the device's integrity and deck randomization process.
Original NVD description (English source)
Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet, SMB, X11) are enabled by default. If an attacker can reach these interfaces - most often through local or near-local access such as connecting to the USB or Ethernet ports beneath the table - the built-in credentials permit administrative login and full control of the system. Once authenticated, an attacker can access firmware utilities, modify controller software, and establish persistent compromise. Remote attack paths via network, cellular, or telemetry links may exist in specific configurations but generally require additional capabilities or operator error. The vendor reports that USB access has been disabled in current firmware builds.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS