Junglewise Threat Intelligence

CVE-2020-5741: Plex Media Server Remote Code Execution Vulnerability

CVE-2020-5741 · Severity: critical · CVSS 7.2 · Exploited in the wild · Published 2023-03-10

Technologies: Plex Media Server. Vendors: Plex.

Executive brief

Plex Media Server on Windows contains a deserialization of untrusted data vulnerability. A remote, authenticated attacker with administrator privileges can exploit this via the Camera Upload feature to upload a malicious file and execute arbitrary Python code.

Affected products

  • Plex Plex Media Server up to (excluding) 1.19.3

Timeline

  • 2020-05-08: disclosed: NVD Published Date
  • 2023-03-10: kev added: Date added to CISA Known Exploited Vulnerabilities Catalog
  • 2023-03-31: patched: Due date for remediation per CISA KEV catalog; updates available in version 1.19.3

Related threats