QNAP has warned users running Plex Media Server on their NAS devices about a critical set of vulnerabilities collectively referred to as Plex2Shell. The company urges immediate installation of available updates to prevent remote takeover by unauthenticated attackers.
Plex provides software for building media servers that stream content to various devices and claims more than 25 million users worldwide. A combination of four vulnerabilities enables attackers to remotely compromise vulnerable Plex media servers. According to QNAP, Plex has confirmed that these flaws are being actively and widely exploited in the wild.
Since proof-of-concept exploit code for Plex2Shell appeared online on 16 October, media servers have become targets of large-scale attacks. Compromised servers are infected with cryptominers that abuse system resources for cryptocurrency mining and with proxy software that allows attackers to conduct additional activities through the hijacked systems.
QNAP has received multiple reports from users whose Plex Media Server installations on NAS devices were compromised via Plex2Shell. The vendor recommends updating the media server through the App Center to version 1.43.3.10861 or newer.
If Plex was accessible from the internet, QNAP advises treating the NAS as potentially compromised. Simply installing the update is insufficient in such cases. A clean reinstallation is recommended along with resetting both Plex and NAS passwords. Users should also disable remote access to Plex when not required and avoid forwarding port 32400. When remote access is necessary, a VPN should be used while ensuring both Plex software and the NAS operating system remain up to date.
