CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server.

The security issues are collectively called Plex2Shell. When chained in an exploit, an attacker can obtain the owner's admin token and execute code with elevated privileges.

Plex Media Server is a popular media suite that helps users organize personal collections of movies, TV shows, music, and photos, and stream them to other devices at home or remotely over the internet.

CISA has directed federal agencies to prioritize patching systems affected by Plex2Shell vulnerabilities or apply mitigations by October 23.

The security issues were discovered by security researcher Zach Main, who reported them responsibly to Plex on July 27.

The individual flaws are rated medium to high in severity, but the researcher assigns the full exploit chain a critical score of 9.8.