Authentication Bypass in General Bytes Crypto Application Server

CVE-2022-4980

What is CVE-2022-4980?

The General Bytes Crypto Application Server, starting from version 20201208 and prior to versions 20220531.38 (backport) and 20220725.22 (mainline), is compromised by an authentication bypass vulnerability in its admin web interface. An unauthenticated attacker can exploit this flaw by accessing the URL used for the initial installation or first admin creation, thereby allowing the attacker to create a new administrative account remotely. This unauthorized access can lead to significant repercussions, such as changing the ATM configuration and redirecting funds. Reports indicate active exploitation of this vulnerability against both cloud-hosted and standalone CAS deployments, particularly targeting instances exposed on ports 7777 and 443. General Bytes publicly acknowledged the issue in September 2022, underlining the importance of patching affected versions.

References