QNAP said on November 6 that some customers' NAS devices appear to have been hacked through "Plex2Shell". A NAS is a storage box on a network. Plex2Shell is four flaws in Plex Media Server, an app that streams media from those boxes. QNAP Technical Support is helping the affected users. Plex says hacked servers ran cryptocurrency miners and proxy software. BleepingComputer reported that attacks began after full details went public on October 16.
Plex says each flaw is a limited risk alone. Chained together, they let an attacker with no login run code with the same rights as the Plex process. QNAP says a server may be reachable from the internet if Plex Remote Access is on, port 32400 is forwarded, or UPnP or router setup opened it. The fix is version 1.43.3.10861, in the QNAP App Center. QNAP says that if Plex 1.43.2 or earlier was reachable from the internet, the NAS should be treated as possibly compromised, because updating does not remove anything already installed. Neither source says how many devices were hit.
A media app on a storage box takes on the box's exposure. QNAP says its own systems are unaffected, yet the box is still at risk. Owners should ask which third-party apps run on their storage, which can be reached from the internet, and who patches them.