Missing authentication in General Bytes Crypto Application Server
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
General Bytes Crypto Application Server (CAS) beginning with version 20201208 prior to 20220531.38 (backport) and 20220725.22 (mainline) contains an authentication bypass in the admin web interface. An unauthenticated attacker could invoke the same URL used by the product's default-installation / first-admin creation page and create a new administrative account remotely. By gaining admin privileges, the attacker can change the ATM configuration resulting in redirected funds. Public vendor advisories and multiple independent writeups describe the vulnerability as a call to the page used for initial/default installation / first administration user creation; General Bytes has not publicly published the exact endpoint/parameter name. The issue was actively exploited in the wild against cloud-hosted and standalone CAS deployments (scanning exposed CAS instances on ports 7777/443), and publicly acknowledged by the General Bytes in September 2022.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| General Bytes | Crypto Application Server (CAS) | 20201208 to before 20220725.22; 20201208 to before 20220531.38 | 20220725.22, 20220531.38 | Patch available | CNA |
- Crypto Application Server (CAS) VendorGeneral Bytes Affected 20201208 to before 20220725.22; 20201208 to before 20220531.38 Fixed in 20220725.22, 20220531.38 Patch available CNA
Remediation
- Fix · CNA Crypto Application Server (CAS) (General Bytes) Fixed in 20220725.22, 20220531.38
Timeline
- 2026-10-02 Threatist record created from CVE-2022-4980
- 2026-10-03 Alias added: GHSA-2wf3-7j9f-p79x
References
Advisory 3
- https://www.halborn.com/blog/post/explained-the-general-bytes-bitcoin-atm-hack-august-2022
- https://news.sophos.com/en-us/2022/08/23/bitcoin-atms-leeched-by-attackers-who-created-fake-admin-accounts/
- https://www.incibe.es/en/incibe-cert/publications/cybersecurity-highlights/0day-vulnerability-exploited-general-bytes
More General Bytes vulnerabilities
- TI-2023-13239 General Bytes Crypto Application Server (CAS) 20230120, as distributed with General Bytes… CVSS 3.1CRITICAL 9.1
Sources
- CVE-2022-4980 · CVE Program
- CVE-2022-4980 · NVD
- FIRST EPSS
- GHSA-2wf3-7j9f-p79x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences