Ethical Hacking News
A growing concern for NAS device owners, the recent discovery of the Plex2Shell vulnerabilities has raised the stakes for those who use these devices to stream media. With the ability to execute arbitrary code on vulnerable servers, attackers can pose a significant risk to NAS device owners. This article provides an in-depth look at the vulnerability chain, QNAP's response, and the importance of prompt updates and patching. Stay informed about the latest security patches and updates to protect your devices from exploitation.
QNAP announced that Plex2Shell vulnerabilities are being used to hack NAS devices, raising concerns about device security. The vulnerability chain can allow attackers to execute arbitrary code on vulnerable servers without valid credentials. The Plex2Shell vulnerability chain was discovered by security researcher Zach Main and published technical details and proof-of-concept code on October 16, 2026. The vulnerabilities can be exploited by attackers to execute arbitrary code on vulnerable servers due to a lack of library checks. QNAP urges users to update Plex Media Server immediately to version 1.43.3 or later. Users should also use a VPN instead of Plex Remote Access, avoid port forwarding, and keep QTS and installed apps up to date. The Cybersecurity and Infrastructure Security Agency (CISA) has added the flaws to its Known Exploited Vulnerabilities catalog. Users must take proactive steps to secure their devices and stay informed about the latest vulnerabilities.
The recent announcement by QNAP that Plex2Shell flaws are being used to hack NAS devices has raised concerns among users about the security of their devices. The vulnerability chain, which combines four vulnerabilities in Plex Media Server, can allow attackers to execute arbitrary code on vulnerable servers without valid credentials. This poses a significant risk to NAS device owners, as a compromised device can be used as an entry point for attackers who have little interest in the user's digital content.
The Plex2Shell vulnerability chain was discovered by security researcher Zach Main and published technical details and proof-of-concept code on October 16, 2026. Within a day, researchers had observed attackers using the exploit against an internet-facing honeypot, deploying cryptocurrency-mining malware and proxy software. This incident highlights the rapid spread of vulnerabilities and the importance of prompt updates and patching.
The vulnerabilities in question, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, can be exploited by attackers to execute arbitrary code on vulnerable servers. This is possible because the loader does not check the library's name, executable permissions, digital signature, or symbols, allowing an attacker to load a specially crafted library and execute code under the service account without requiring an interactive login.
QNAP urges users to update Plex Media Server immediately, as users who have Plex Media Server running version 1.43.2 or earlier and are reachable from the internet while running this version should treat their NAS as potentially compromised. This may apply if Plex Remote Access was enabled, port 32400 was forwarded, or the port was opened automatically through UPnP or router settings.
To mitigate this risk, QNAP recommends that users update Plex Media Server to version 1.43.3 or later, and check in Plex Web, under Settings and General, that the installed version is 1.43.3.10861 or later. Users who need remote access should use a VPN instead of Plex Remote Access, and avoid port forwarding for port 32400. Additionally, users should keep QTS or QuTS hero and all installed apps up to date.
The incident is a reminder of how quickly a public exploit can be weaponized by threat actors. It is essential for users to stay informed about the latest vulnerabilities and take proactive steps to secure their devices. QNAP's response to this vulnerability is a good example of the importance of prompt patching and updates.
In response to the discovery of the Plex2Shell vulnerabilities, the Cybersecurity and Infrastructure Security Agency (CISA) has added the flaws to its Known Exploited Vulnerabilities catalog, urging federal agencies to address them by October 23, 2026. This is a timely reminder of the importance of staying up-to-date with the latest security patches and updates.
The rapid spread of vulnerabilities like the Plex2Shell chain highlights the need for a proactive approach to security. Users must be vigilant and take steps to protect their devices from exploitation. QNAP's recommendations and the CISA's warning serve as a reminder of the importance of security and the need for prompt action.
In conclusion, the discovery of the Plex2Shell vulnerabilities and QNAP's response to this issue are significant concerns for NAS device owners. The rapid spread of vulnerabilities and the importance of prompt updates and patching cannot be overstated. Users must take proactive steps to secure their devices and stay informed about the latest vulnerabilities.
Related Information:
https://www.ethicalhackingnews.com/articles/Exploiting-the-Vulnerabilities-of-Plex-Media-Server-A-Growing-Concern-for-NAS-Device-Owners-ehn.shtml
https://securityaffairs.com/202708/cyber-crime/qnap-warns-users-as-plex2shell-flaws-are-used-to-hack-nas-devices.html
Published: Mon Nov 9 11:14:53 2026 by llama3.2 3B Q4_K_M
