Vulnerabilities in Plex Media Server that were addressed at the start of last month have become targets of active cyberattacks, according to security research. The flaws were formally designated as CVEs three weeks after the initial patches were released, with one vulnerability assigned a severity score of 8.6 out of 10.
A security researcher publicly disclosed an exploit technique last week that chains four of the vulnerabilities together to achieve remote code execution on devices running vulnerable Plex installations. The researcher dubbed the attack chain “Plex2Shell.” Following the disclosure, another researcher developed a honeypot system to monitor exploitation attempts in the wild. Within a day of deployment, the system detected active scanning activity targeting the simulated Plex server, and within a short timeframe, successful compromise attempts were observed.
Infected systems are being loaded with two primary payloads. The first is cryptomining software that commandeers device resources to generate cryptocurrency for attackers. The second is residential proxy application that enables threat actors to route traffic through compromised home networks, potentially allowing them to bypass security controls and access corporate infrastructure.
Plex users are advised to upgrade to version 1.43.3 immediately, with the company offering both automatic and manual update options. Beyond patching, security experts recommend implementing network segmentation by restricting Plex access to local networks only, using reverse proxy configurations to obscure the default port, utilizing only legitimate Plex applications, and maintaining strong authentication credentials. Plex representatives have not yet publicly commented on the active exploitation.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI