QNAP says hackers are breaking into some of its network-attached storage devices through security flaws in Plex Media Server. Households using a QNAP NAS for backups, photos, or streaming should update Plex immediately—and take stronger recovery steps if the server was exposed to the internet.
What happened
According to BleepingComputer, QNAP received multiple reports of suspected compromises involving Plex Media Server on customers’ NAS devices. Attackers are exploiting a group of four Plex vulnerabilities known together as Plex2Shell.
Exploitation began after technical details became public in October. The U.S. Cybersecurity and Infrastructure Security Agency later added all four vulnerabilities to its list of flaws known to be exploited in real attacks.
QNAP says the weaknesses are in Plex Media Server, not in its QTS or QuTS hero operating systems. However, a successful Plex attack can still put the NAS and the personal files stored on it at risk.
Installing the update blocks the known vulnerabilities, but it does not remove malicious software that an attacker may already have placed on a compromised NAS.
Who is affected
The warning applies to people running Plex Media Server on a QNAP NAS, especially when Plex can be reached directly from the public internet. QNAP says users should consider the NAS and all content on it compromised if a vulnerable Plex installation was publicly exposed.
QNAP identifies Plex Media Server 1.43.3.10861 as the protected version available through its App Center. The company recommends installing the newest version offered there. The affected QNAP models have not been disclosed in the provided report.
What to do now
Sign in to the QNAP administration page, open App Center, find Plex Media Server, and install the latest available update. Confirm that Plex shows version 1.43.3.10861 or later when the installation finishes.
If you do not need Plex while away from home, open its remote-access settings and disable remote access. Then sign in to your router, find Port Forwarding, NAT, or Virtual Server settings, and remove any rule forwarding TCP port 32400 to the NAS.
If remote access is necessary, stop exposing Plex directly and use a VPN connection instead. Review CyberSec24’s home VPN setup guide before changing your network.
If the NAS ran a vulnerable Plex version while exposed to the internet, follow QNAP’s compromise-checking and recovery instructions. QNAP recommends a clean reinstall of QTS or QuTS hero, followed by resets of both the Plex password and NAS credentials. Do not assume that updating Plex alone removed an attacker’s files.
Contact QNAP technical support if you see unfamiliar accounts, settings, processes, or files. QNAP has offered to examine logs from devices that may have been breached.
How to protect your home network
Keep the NAS and other internet-connected storage devices updated, limit remote access, and review router port-forwarding rules regularly. CyberSec24’s home network security guide explains additional ways to reduce exposure.
Sources
- QNAP says hackers breaching NAS devices in Plex2Shell attacks — BleepingComputer
Written by the CyberSec24 news desk with AI assistance, from the sources above. Spot an error? Tell us and we'll correct it.