Vulnerability · high
Plex2Shell chain exploited to breach QNAP NAS devices
Tier A · Patch today – Before you go home
Who’s exposed: QNAP NAS users running Plex Media Server
Tier A because: Core infrastructure or popular tool AND exploited in the wild
Reach
Attack
Damage
Fix
Popular tool · Exploited in the wild
What to do
- Update Plex Media Server through the QNAP App Center
The Brief
- Threat actors are exploiting the Plex2Shell four-flaw vulnerability chain to compromise QNAP NAS devices.
- The attacks target the Plex Media Server application running on QNAP NAS devices.
- QNAP urges users to update Plex Media Server through the QNAP App Center.
Why it matters
Active exploitation of a chain of four flaws means NAS devices running Plex Media Server can be compromised, so affected owners should patch promptly.
The checklist behind the tier
Checklist · 3 of 10 yes
| Yes | Hits tech teams | Judgment: Plex Media Server on QNAP NAS is a server application on storage appliances that IT and ops teams run. |
| No | Core infrastructure | Judgment: a Plex Media Server chain on QNAP NAS is not core infrastructure like OpenSSH or the Linux kernel. |
| Yes | Popular tool | Judgment: Plex Media Server and QNAP NAS are widely deployed products with large user bases. |
| Yes | Exploited in the wild | SecurityWeek: threat actors are exploiting the four-flaw chain to hack Plex Media Server on QNAP NAS. |
| No | Public exploit | No source says exploit code or a proof-of-concept has been published. |
| No | Remote, no login | No source states that the attack works over the network without credentials. |
| No | Full takeover | Sources report NAS compromises but do not explicitly state code execution or root/admin access. |
| No | Secrets exposed | No source says credentials, configs or user data were stolen or exposed. |
| No | Supply chain | No source says malicious code was shipped through an official update, package or build pipeline. |
| No | No fix yet | Security Affairs: QNAP urges users to update Plex Media Server through the QNAP App Center, so a fix exists. |
Timeline
BleepingComputer
QNAP says hackers breaching NAS devices in Plex2Shell attacks
QNAP warns users to update Plex Media Server after reports of Plex2Shell exploitation
SecurityWeek
Plex2Shell Exploited Against QNAP NAS Users
Security Affairs
QNAP Warns Users as Plex2Shell Flaws Are Used to Hack NAS Devices
Full coverage · 3 sources
First seen · 3 sources · Full story page · How tiers are decided