Originally published on satyamrastogi.com

QNAP warns of active Plex2Shell exploitation targeting NAS devices. Threat actors chain Plex Media Server vulnerabilities for pre-auth RCE. Immediate patching required.

Executive Summary

QNAP has issued a critical security advisory regarding active exploitation of the Plex2Shell vulnerability chain affecting Plex Media Server instances running on QNAP NAS devices. Threat actors are leveraging multiple Plex vulnerabilities to achieve unauthenticated remote code execution (RCE) with SYSTEM-level privileges. The attack requires no user interaction and can be triggered remotely by an attacker with network access to the NAS device. QNAP is urging all users to immediately update Plex Media Server through the QNAP App Center to the latest available version.

Attack Vector

The Plex2Shell chain exploits a combination of vulnerabilities in Plex Media Server, a popular media streaming application frequently installed on QNAP NAS systems.…