{"id":4123,"date":"2026-11-10T09:50:33","date_gmt":"2026-11-10T17:50:33","guid":{"rendered":"https:\/\/cyber.mag212.com\/?p=4123"},"modified":"2026-11-10T09:50:33","modified_gmt":"2026-11-10T17:50:33","slug":"plex2shell-plex-media-server-qnap-nas-exploited-port-32400","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/plex2shell-plex-media-server-qnap-nas-exploited-port-32400\/","title":{"rendered":"Plex2Shell: Four Unauthenticated Plex Flaws Exploited Against QNAP NAS Owners \u2014 Update and Close Port 32400"},"content":{"rendered":"

QNAP is warning NAS owners that Plex Media Server installations on their devices are being compromised through Plex2Shell, a chain of four vulnerabilities that needs no login. Exploitation has been widespread since mid-October, after proof-of-concept code was published. QNAP\u2019s own operating systems are not affected, but a vulnerable media server with port 32400 forwarded to the internet sits right next to the files, and often the backups, that the NAS exists to protect.<\/p>\n\n\n\n

CVE<\/strong><\/td>CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 (Plex Media Server)<\/td><\/tr>
Affect\u00e9<\/strong><\/td>Plex Media Server installations reachable from the internet, including on QNAP NAS<\/td><\/tr>
Non affect\u00e9<\/strong><\/td>QNAP QTS and QuTS hero themselves<\/td><\/tr>
Fix\u00e9 dans<\/strong><\/td>Plex Media Server 1.43.3.10861 or later (SecurityWeek: 1.43.3 or later)<\/td><\/tr>
Exploit\u00e9<\/strong><\/td>Yes, described as widespread since mid-October<\/td><\/tr>
Data loss<\/strong><\/td>None reported by QNAP<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Ce qui s'est pass\u00e9<\/h2>\n\n\n\n

In a notice reported on 9 November, QNAP warned of widespread exploitation of Plex2Shell, four unauthenticated remote-code-execution flaws in Plex Media Server. Exploitation began in mid-October once proof-of-concept code appeared, and QNAP says some users have reported Plex servers that appear compromised. The company stresses that QTS and QuTS hero are not affected and that no data loss has been reported (Semaine de la s\u00e9curit\u00e9<\/a>). The title of QNAP\u2019s notice tells users to update to Plex Media Server 1.43.3.10861 or later immediately (QNAP notice<\/a>); SecurityWeek gives the fix as 1.43.3 or later. We recommend the more specific build.<\/p>\n\n\n\n

Qui est concern\u00e9 ?<\/h2>\n\n\n\n

Analyse CYBER MAG212\u00a0:<\/strong> the exposed group is anyone running Plex on a QNAP or other NAS with Plex Remote Access enabled or port 32400 forwarded through the router. That describes many small offices, schools and home offices, where a NAS doubles as file server, backup target and media library. Plex users on other platforms should apply the same update, because the flaws are in Plex, not in QNAP.<\/p>\n\n\n\n

Comment fonctionne l'attaque<\/h2>\n\n\n\n

The four flaws together allow remote code execution without authentication against an internet-reachable Plex Media Server. The reporting we reviewed does not describe each step of the chain, the actor behind the attacks or what they install afterwards, and no indicators of compromise were published (Semaine de la s\u00e9curit\u00e9<\/a>). No ransomware involvement has been reported.<\/p>\n\n\n\n

\"Network
Exposed versus hardened: why a forwarded port 32400 is the real problem. Conceptual network model, not an incident capture. Diagram: MAG212 CYBER<\/figcaption><\/figure>\n\n\n\n

Que rechercher<\/h2>\n\n\n\n

Because no indicators have been published, start from exposure rather than signatures. Check whether port 32400 is forwarded on your router or firewall, whether Plex Remote Access is enabled, and whether the Plex server or NAS shows accounts, scheduled tasks or files you don\u2019t recognise. QNAP has published a check-and-remediation FAQ for its customers (QNAP FAQ<\/a>); we have not reviewed its contents, so follow it directly rather than relying on our summary.<\/p>\n\n\n\n

Why NAS-hosted apps keep getting hit<\/h2>\n\n\n\n

Analyse CYBER MAG212\u00a0:<\/strong> network storage devices are attractive because they combine three things attackers want: they are often reachable from the internet for convenience, they run add-on applications that are patched less carefully than the operating system, and they hold data an organisation cannot afford to lose. Plex2Shell fits that pattern exactly. The NAS vendor did its part, and QNAP\u2019s own system is not affected, but the exposure came from a third-party media server and a forwarded port.<\/p>\n\n\n\n

For a school or small business, the practical consequence is that a home-media feature can become the entry point to the device holding staff files and backups. That is why the containment steps below start with assuming compromise, not with the update.<\/p>\n\n\n\n

Investigate, contain and fix<\/h2>\n\n\n\n
    \n
  1. Treat any NAS whose Plex server was reachable from the internet as potentially compromised (Semaine de la s\u00e9curit\u00e9<\/a>).<\/li>\n\n\n
  2. Disable Plex Remote Access and stop forwarding port 32400. If you need remote viewing, put it behind a VPN.<\/li>\n\n\n
  3. Reinstall Plex and update to Plex Media Server 1.43.3.10861 or later.<\/li>\n\n\n
  4. Rotate the Plex account password and every NAS account password.<\/li>\n\n\n
  5. Work through QNAP\u2019s remediation FAQ (QNAP FAQ<\/a>).<\/li>\n\n<\/ol>\n\n\n\n

    No vendor-sourced commands were available, so we are not publishing any.<\/p>\n\n\n\n

    How to confirm you\u2019re clean<\/h2>\n\n\n\n