Plex2Shell flaw chain under active attack against QNAP NAS owners running Plex
Owners of internet-exposed QNAP devices running Plex Media Server should update now and assume a possible compromise.
Attackers are exploiting a four-flaw chain called Plex2Shell in Plex Media Server running on QNAP NAS devices, after proof-of-concept code was published in mid-October. The chain, patched this summer, can be exploited without valid credentials and lets an attacker run arbitrary code with the privileges of the Plex service. QNAP says its technical support team has confirmed that no data loss occurred for affected users. The vendor says only Plex Media Server is vulnerable, not QTS, QuTS hero or its other operating systems, and recommends updating to Plex Media Server 1.43.3 or later. Internet-exposed devices should be treated as potentially compromised, with Plex reinstalled and Plex and NAS passwords rotated.
Why it matters
The attack needs no login, so any Plex Media Server on a QNAP NAS that is reachable from the internet is exposed to code running with the Plex service's privileges. QNAP says the flaw sits only in Plex Media Server and not in its own operating systems, which narrows the group affected to Plex users on those devices. For them the immediate change is that the fix in version 1.43.3 or later and a reinstall with new passwords are now the expected response, not a precaution. QNAP's report of no data loss offers some reassurance, but it does not show that a compromised device is clean.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.