Plex Patches Critical Vulnerabilities in Media Server

Key Takeaways

• Plex has released urgent security updates for its Media Server and Desktop applications.
• The patches address multiple unspecified critical vulnerabilities in versions 1.43.2 and earlier of Plex Media Server, and affected Plex Desktop installations.
• Users are strongly advised to update to Plex Media Server version 1.43.3 and Plex Desktop version 1.115.0 immediately.
• While specific technical details remain undisclosed, the flaws could lead to unauthorized access, data exposure, or service disruption.

Plex Issues Critical Security Updates for Media Server

Plex has rolled out an urgent security update for its widely used Plex Media Server and Plex Desktop applications, urging all users to install the latest versions without delay. The company has not yet disclosed the technical specifics of the vulnerabilities, but the immediate call to action suggests a high level of risk.

The update specifically targets multiple undisclosed security issues present in Plex Media Server versions 1.43.2 and earlier, as well as associated Plex Desktop installations. To mitigate these threats, Plex has released Plex Media Server version 1.43.3 and Plex Desktop version 1.115.0.

As of this report, Plex has refrained from publishing comprehensive technical details regarding the vulnerabilities. Information such as severity ratings, exploit requirements, affected components, or potential impact remains under wraps. The company has stated it is awaiting the assignment of CVE identifiers and will provide more information once these are published.

The absence of public vulnerability details means that administrators should treat these updates with extreme urgency. This is particularly crucial for Plex servers exposed to the internet, those utilizing remote-access features, or systems housing extensive personal media libraries. Depending on the nature of the flaws, a compromised media server could potentially facilitate unauthorized access, data breaches, service disruptions, or further system compromises.

Broad Platform Impact and Patch Management

Plex Media Server enjoys widespread deployment across various platforms, including Windows, macOS, Linux, network-attached storage (NAS) devices, Docker environments, and NVIDIA Shield devices. This extensive compatibility underscores the importance of diligent patch management, as update availability and installation procedures can vary significantly across different operating systems and hardware vendors.

Windows and macOS users with automatic updates enabled should verify that their Plex Media Server is running version 1.43.3 or newer. For those who do not receive the update automatically, the latest server package can be downloaded directly from Plex’s official Media Server downloads page. Plex also recommends that Desktop users upgrade to Plex Desktop version 1.115.0.

Linux administrators should download the appropriate installation file for their specific distribution; for instance, Ubuntu and Debian-based systems use the .deb package, while Fedora and CentOS-based deployments require the .rpm package. It is critical for administrators to verify the downloaded filename before executing installation commands and to restart or validate the service post-deployment. NAS users might experience delays as vendor-managed application stores do not always publish new Plex packages immediately. In such cases, Plex advises affected users to manually download the correct package for their NAS model and install it via the device’s web-based app management interface, providing guidance for QNAP, TerraMaster, Western Digital, Netgear, and Synology systems.

Docker users must adhere to Plex’s official container deployment guidance, ensuring they pull and deploy an image that incorporates the fixed Plex Media Server release. Organizations running Plex in containerized environments should also review image tags, container restart policies, exposed ports, remote access settings, and reverse-proxy configurations to ensure comprehensive security.

Administrators should not rely solely on update notifications. It is imperative to open the Plex server dashboard or package manager and confirm the installed version after applying the patch. Additionally, security teams may consider reviewing server logs for any unusual login attempts, unexpected remote connections, new administrator sessions, or unexplained configuration changes while awaiting further CVE and technical disclosure details from Plex.

What You Should Do

• Update Immediately: Ensure your Plex Media Server is updated to version 1.43.3 or later, and Plex Desktop to version 1.115.0.
• Verify Installation: After updating, confirm the new version number through the Plex server dashboard or package manager.
• Review Remote Access: If your Plex server is exposed to the internet or uses remote access features, prioritize this update.
• Monitor Logs: Review server logs for any suspicious activity, such as unusual logins or configuration changes, especially until more technical details are released.
• Follow Vendor-Specific Instructions: For NAS and Docker deployments, follow Plex’s and your hardware vendor’s specific update instructions carefully.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.