CVE-2022-4980
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedGeneral Bytes Crypto Application Server (CAS) beginning with version 20201208 prior to 20220531.38 (backport) and 20220725.22 (mainline) contains an authentication bypass in the admin web interface. An unauthenticated attacker could invoke the same URL used by the product's default-installation / first-admin creation page and create a new administrative account remotely. By gaining admin privileges, the attacker can change the ATM configuration resulting in redirected funds. Public vendor advisories and multiple independent writeups describe the vulnerability as a call to the page used for initial/default installation / first administration user creation; General Bytes has not publicly published the exact endpoint/parameter name. The issue was actively exploited in the wild against cloud-hosted and standalone CAS deployments (scanning exposed CAS instances on ports 7777/443), and publicly acknowledged by the General Bytes in September 2022.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceAuthentication bypass vulnerability in General Bytes Crypto Application Server allows unauthenticated attackers to access the initial installation/first-admin creation page and create new administrative accounts remotely. This grants full admin privileges enabling ATM configuration changes and fund redirection.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- Authentication
- X
- User interaction
- None
- Scope
- X
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify General Bytes Crypto Application Server installationLocate the application process or installation directory - typically runs as a Java service on Linux servers. Check for processes named 'cas' or 'cryptoatm' or look for the installation path (commonly /opt/cas or /usr/local/cas).Affected if The software is present and running on the system.
-
Determine installed versionCheck the application's version - this is usually displayed in the web UI footer, in a version file within the installation directory (such as VERSION, build.info, or in the application.properties file), or via a command like 'cas --version' if available.Affected if The version is earlier than 20220531.38 (backport) or 20220725.22 (mainline), or the version cannot be determined and the software appears unpatched.
-
Verify initial setup page is accessible without authenticationAttempt to access the installation page via HTTP/HTTPS on ports 7777 or 443. The typical path is /admin/install or the root URL on a fresh installation. Try accessing the URL from an unauthorized browser (incognito window with no session cookies).Affected if The initial setup or first-admin creation page loads without requiring any authentication credentials.
-
Audit for unauthorized admin accountsLog into the admin interface with an existing admin account and review the user management or admin accounts list. Look for unexpected accounts, especially any created recently or with usernames you do not recognize.Affected if There are administrative accounts present that were not created by your organization or that you cannot account for.
-
Check network exposure of management portsDetermine if ports 7777 (default HTTP) and 443 (HTTPS) are exposed to the internet or untrusted networks. Use tools like 'nmap -p 7777,443 <external-ip>' or review firewall rules.Affected if These ports are accessible from untrusted network segments or the public internet.
You are affected if the General Bytes Crypto Application Server is installed, the version is earlier than the patched releases, and either the initial setup page is accessible without auth OR unauthorized admin accounts exist in the system.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedApply vendor patches (20220531.38 backport or 20220725.22 mainline) and audit for unauthorized admin accounts created via this vulnerability; restrict network access to ports 7777/443 if patching is delayed.
20220531.38 (backport branch) or 20220725.22 (mainline branch)
- Identify the currently deployed CAS version by checking the admin interface or system files
- Determine which branch is in use (backport or mainline) by reviewing the version numbering
- For backport branch: upgrade to version 20220531.38 or later
- For mainline branch: upgrade to version 20220725.22 or later
- Before upgrading, create a full backup of the CAS database and configuration files
- Review General Bytes upgrade documentation for branch-specific migration procedures
- Stop the CAS service before applying the upgrade
- Apply the upgrade following vendor-provided installation instructions
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation4.0 h
- Implementation8.0 h
- Testing4.0 h
- Review / QA3.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,408.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2022-4980 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2022-4980 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data