CISA warns agencies of active Plex2Shell exploitation
CISA says four Plex Media Server vulnerabilities can be combined to gain administrative access and run code with elevated privileges. The agency ordered federal agencies to patch or mitigate by October 23, and the affected software predates version 1.43.3.10861. Public exploit details and a proof-of-concept appeared before reports of attacks against honeypots that installed a cryptocurrency miner.
Plex2Shell combines four Plex Media Server flaws. Chained, they can yield the owner’s admin token and let an attacker run code with elevated rights. Researcher Zach Main reported the issues to Plex on July 27; individual bugs were rated medium to high, while the full chain received a 9.8 critical score. Technical details appeared October 16, a proof-of-concept followed three days later, and honeypot attacks deploying a cryptominer were reported October 17. Versions before 1.43.3.10861 are affected.
CISA’s KEV catalog also gained a Siemens Software Center search-path flaw tied to Romulus ClickFix campaigns, and a SiteGuard WAF command-injection flaw flagged by the vendor and Japan’s CERT. Siemens urged updating to 4.0.9.8 or later; SiteGuard fixes vary by platform.
The Plex2Shell warning may affect federal agencies, self-hosted Plex users, and small organizations that expose media servers to the internet. Successful chaining could let intruders gain administrative control, run malicious code, or quietly deploy cryptominers, potentially exposing personal media libraries and connected systems. CISA’s deadline could accelerate patching among agencies, but home and small-business operators may lag, leaving exposed instances at risk. The related KEV additions suggest defenders may need to prioritize multiple actively exploited enterprise tools at once.