QNAP says Plex2Shell attackers are getting into home NAS boxes, and updating Plex isn't enough

Three weeks ago we wrote about Plex2Shell, the four-bug chain that hands an out-of-date Plex Media Server to anyone on the internet. On 6 November the story moved closer to home. QNAP said some of its customers have reported that Plex on their NAS appears to have been compromised this way, and its support team is now helping them.

QNAP is careful to say its own systems, QTS and QuTS hero, aren't the weak point. The flaws live in Plex. That's thin comfort when Plex is running on the box that holds fifteen years of family photos. The fix is Plex Media Server 1.43.3.10861 or later, which is in the App Center, and CISA added all four CVEs to its list of exploited vulnerabilities on 20 October. The harder message sits in QNAP's FAQ: if Plex was reachable from the internet while running 1.43.2 or earlier, updating alone is not enough, because whatever an attacker dropped on the box stays there.

The company's checklist is refreshingly specific. Look for processes called myawesomeproxy, mylovelyminer or x12345, unfamiliar .so or .dll files in Plex's Codecs folder, connections to proxystream.st, and the processor working hard while nothing is playing. If the server was exposed, remove Plex and reinstall a fixed version without restoring the old Codecs folder, sign out every Plex device, and change the Plex, NAS and backup passwords. BleepingComputer's reading of the advisory goes further and lists a clean reinstall of QTS or QuTS hero. Then switch off Remote Access and UPnP, stop forwarding port 32400, and use a VPN if you want to watch from outside the house.

Plenty of people forget the NAS is even there until something like this happens, and Tendvane's Network scan lists every device on your home network so the forgotten ones show up again.