Plex flaws exploited to install miners and proxies on QNAP NAS devices
Plex Media Server running on QNAP NAS devices was compromised through the Plex2Shell exploit chain. Attackers remotely executed malware without authentication and installed cryptocurrency miners and residential proxy programmes on some devices. QNAP recommended updating to the latest version and said it was supporting affected users, with no confirmed data loss.
Key facts
- Affected organisation
- QNAP
- Incident type
- Malware
- Occurred / detected
- Not confirmed
- Scale of damage
- Some users' NAS devices compromised; number of affected devices not disclosed
- Cause / method
- Unauthenticated remote code execution through chained exploitation of Plex2Shell vulnerabilities in Plex Media Server
- Location
- Taiwan
Timeline
- QNAP issued an urgent security warning about real-world compromises exploiting Plex Media Server vulnerabilities and recommended updating.
- The installation of cryptocurrency miners and residential proxy programmes on compromised devices became public, and QNAP said it was supporting affected users and that no data loss had been confirmed.
5 related reports
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.