External risk intelligence

General Bytes CAS Admin Authentication Bypass Allows Remote Account Creation

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2022-4980

The affected product, a Crypto Application Server, is designed to manage internet-connected devices (ATMs) and is commonly deployed with web-accessible interfaces on ports 7777 or 443 to facilitate remote management and operations. Its function as a central gateway for remote hardware makes it public-facing by design in normal deployment scenarios.

Missing Authentication

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in General Bytes Crypto Application Server allows an unauthenticated attacker to bypass authentication and create a new administrative account remotely, potentially leading to redirected funds. The issue affects the web interface used for initial administrative setup.

Unauthenticated attackers can create admin accounts.
Allows attackers to control ATM configuration.
Confirm exposure and assess potential financial risk.

Attack Path

How an attacker could exploit the issue

An attacker can remotely create a new administrative account on the Crypto Application Server by targeting the same URL used for initial setup, bypassing authentication. Once an administrator account is established, the attacker can alter the ATM's configuration to redirect funds.

No prior authentication required.
Invokes the first admin creation page.
Gaining unauthorized administrative access.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker can create a new administrative account on the Crypto Application Server by invoking a specific URL. This could allow them to change ATM configurations, potentially redirecting funds. The vulnerability has been observed being actively exploited in the wild against cloud-hosted and standalone CAS deployments.

ATM configuration and funds.
Unauthenticated remote URL invocation.
Redirected cryptocurrency transactions.

Operational Fix

Recommended remediation, mitigation, and detection steps

The initial administrative interface of General Bytes CAS is vulnerable to authentication bypass, allowing remote attackers to create new administrative accounts. This could lead to redirected funds through ATM configuration changes. Teams responsible for the CAS application and its underlying infrastructure should prioritize identifying all deployed instances, confirming their exposure and criticality, and then planning remediation.

Application owners should own the issue.
Verify CAS instances and public exposure.
Plan coordinated remediation or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the General Bytes Crypto Application Server?

The Crypto Application Server (CAS) is the backend software platform that manages and monitors networks of cryptocurrency ATMs. It acts as a central control point, allowing operators to oversee hardware configuration, transaction processing, and general machine health remotely.

How does CVE-2022-4980 create an authentication bypass?

This vulnerability is classified as CWE-306, which refers to a failure to check for authentication before performing a sensitive action. In this case, the web interface mistakenly allows unauthenticated users to access the same URL used to create the initial administrator account, letting them create a new, rogue administrative profile without needing existing credentials.

When does this vulnerability trigger?

The flaw is triggered when an attacker successfully calls the page intended for the software's initial setup and first-admin creation. It is important to note that accessing other administrative pages or sub-sections of the CAS interface does not inherently trigger this specific vulnerability; the risk is strictly tied to reaching that specific setup endpoint.

Is my instance at risk?

According to Halo Surface Signal, this software is often deployed with web interfaces exposed on ports 7777 or 443 to enable remote ATM management. Because the CAS functions as a gateway for hardware, its design often makes it internet-facing. If your instance is reachable from the internet, it is highly relevant to your security posture.

What should I do to secure my CAS installation?

Prioritize identifying all deployed CAS instances within your environment to confirm if they are exposed to the network. Once located, verify their current version against the vendor's secure releases. If your instance is vulnerable, coordinate with your technical team to apply the official patches or engage directly with the vendor for remediation guidance.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.