QNAP warned Friday that owners who ran a vulnerable version of Plex Media Server on an internet-accessible QNAP storage device should treat the device as potentially compromised. The company says to install Plex Media Server build 1.43.3.10861 or later. If the older server was reachable from the internet, QNAP recommends a clean reinstall of the Plex application, checks for signs of intrusion and credential resets.
The flaws affect Plex Media Server, the app that streams a personal media library from the device. QNAP says its QTS and QuTS hero operating systems are outside the scope of these flaws. A QNAP device without Plex Media Server needs no action for this specific issue.
Check the build and whether Plex was reachable
Open App Center on the QNAP device and check Plex Media Server under My Apps. Check the full build in Plex as well. Censys documented that an earlier 1.43.3 build, 1.43.3.10828, is also vulnerable. Plex reported in October that attackers had used compromised servers to run cryptocurrency miners and proxy software.
If you ran an affected build, check whether Plex Remote Access was enabled or whether your router forwarded port 32400. QNAP's recovery FAQ also covers automatic router configuration. The patch closes the route used by attackers. It cannot remove software someone already installed or revoke a stolen login token.
If your server was exposed
Follow QNAP's recovery steps in order. If you want QNAP to help investigate, copy the Plex logs before removing the app. QNAP says to check for leftover Plex files after removal and to keep the old Codecs contents out of the clean installation. Its checklist includes unfamiliar processes, unusually high CPU use when nothing is playing and alerts from QNAP's Malware Remover.
After the reinstall and compromise checks, QNAP says to sign out all devices in Plex before changing your Plex password. The company also advises changing NAS passwords and rotating credentials stored on the device for connected services, such as backups.
