Plex2Shell chain of four Plex Media Server flaws exploited against QNAP NAS users
Plex servers on QNAP NAS devices can be hacked!
Summary
Attackers are actively using Plex2Shell, a chain of four flaws in Plex Media Server, against QNAP NAS users. No credentials are needed, and attackers could run arbitrary code on exposed servers.
Affected when
- Plex Media Server reachable from the internet
What to do
Update Plex Media Server to 1.43.3 or later. Devices accessible from the internet should be considered potentially compromised: reinstall Plex and rotate the Plex and NAS passwords. If you do not need remote access, disable Plex Remote Access and do not forward port 32400. If you need it, use a VPN.
Can't update yet?
Add this line to the config file:
disable Plex Remote Access and do not forward port 32400
A wrong setting can stop the service or lock you out. Check the source links below first.
Products and platforms
Sources
Times
First published
First seen