Plex Urges Users to Update Media Server and Desktop After Fixing Security Flaws
Summary
Plex fixed multiple security flaws in Plex Media Server 1.43.3 and Plex Desktop 1.115.0, with CVE identifiers pending. It urges users to update promptly and says NAS users may need to install the package manually.
Key points
- Plex released fixes for multiple security flaws in Plex Media Server 1.43.3 and Plex Desktop 1.115.0; details and CVE identifiers are pending.
- Plex recommends that server owners and Desktop users update as soon as possible.
- NAS users may need to install the updated Plex Media Server package manually if it is not yet available through their package manager.
- A 2025 Plex flaw, CVE-2025-34158, exposed server owners’ account details and administrative tokens to authenticated lower-privileged users; a subsequent API call could reveal other accessible servers.
- Plex previously fixed a flaw that could let attackers amplify UDP denial-of-service traffic. The article also says the 2022 LastPass breach followed the compromise of an employee’s home computer through a Plex Media Server vulnerability, CVE-2020-5741.
Article Details
- Vulnerability Types
- Authentication flaw
- Sensitive information exposure
- UDP reflection enabling denial-of-service amplification
- Severity
- The newly fixed flaws' severity is not disclosed. CVE-2025-34158 was described as high severity (CVSS 8.5); CVE-2020-5741 had a CVSS score of 7.2.
- Affected Versions
- Plex Media Server 1.43.3
- Plex Desktop 1.115.0
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- For Plex Media Server on NAS devices where the update is not yet available in the package manager, install the updated package manually.
MITRE ATT&CK
T1003 · OS Credential DumpingAttackers implanted keylogger malware on a LastPass employee's home computer after compromising it through CVE-2020-5741.T1557.002 · ARP Cache PoisoningThe 2021 Plex issue allowed attackers to make an affected server reflect UDP packets to increase the volume of a denial-of-service attack against another server.
CVE
CVE-2020-5741The alert follows past Plex issues, including CVE-2025-34158 and CVE-2020-5741, which were tied to account exposure and the LastPass breach.CVE-2025-34158The alert follows past Plex issues, including CVE-2025-34158 and CVE-2020-5741, which were tied to account exposure and the LastPass breach.
Vendors
Products
Plex DesktopPlex is urging users to update Plex Media Server and Plex Desktop after releasing fixes for multiple security flaws, with CVE identifiers still pending.Plex Media ServerPlex is urging users to update Plex Media Server and Plex Desktop after releasing fixes for multiple security flaws, with CVE identifiers still pending.