QNAP warns Plex app on NAS devices is being hacked through Plex2Shell flaws

QNAP, which makes network-attached storage (NAS) devices, says some customers' devices appear to have been compromised through Plex Media Server. A NAS is a small computer with built-in drives that stores and shares files across a network, and many offices use one for backups and shared files. Plex is an optional app that streams video and music from the NAS.

The attacks use Plex2Shell, a chain of four vulnerabilities in Plex Media Server. Attacks started soon after full technical details were published in October, and CISA has listed all four flaws as actively exploited. QNAP says the problem is in Plex itself, not in QNAP's own operating systems.

QNAP recommends updating Plex Media Server through the QNAP App Center to version 1.43.3.10861 or later. However, updating will not remove anything an attacker already installed. If a vulnerable Plex server was reachable from the public internet, QNAP says to treat the NAS and all its content as compromised.

For those devices, QNAP advises checking for the signs of compromise listed in its bulletin, doing a clean reinstall of the NAS operating system, and then resetting Plex and NAS passwords. QNAP has published a step-by-step guide and offers to review logs from suspected compromises through its support portal. For a business, a NAS often holds backups and sensitive files, so an unneeded entertainment app on it adds risk.