QNAP is warning that attackers are already breaching its network storage appliances through a chain of flaws in Plex Media Server, and is telling customers to install the current build of the app straight from the official App Center.
The alert covers a vulnerability chain known as Plex2Shell, which QNAP says is being exploited in the wild against NAS devices. The company's instruction to users is unambiguous: pull the latest Plex Media Server release from the QNAP App Center, and do not fall back on an older build or a separately downloaded installer.
The disclosure matters because of where the vulnerable code actually sits. Plex Media Server is not part of QNAP's own stack — it is a third-party application distributed through the vendor's app ecosystem, running on its own patch schedule. Administrators who keep their NAS firmware up to date can still be exposed when the apps layered on top of it lag behind. A modern NAS increasingly behaves less like a sealed appliance and more like a small application platform, with all the patching complexity that implies.
A third-party app, not QNAP's own code
That pattern is familiar ground for QNAP owners. The company's devices have been a recurring target for ransomware operators: Qlocker in 2021 encrypted users' archives by abusing QNAP's HybridBackup Sync, and DeadBolt followed in 2022, hitting systems running the Multimedia Streaming Add-on and, later, QTS itself. Plex2Shell continues that history through a different door — one opened by an application rather than the operating system.
Why the backup angle is the serious one
The most consequential risk emerges where the NAS doubles as an organisation's backup destination. Once an attacker gains a foothold on the storage box, the copies an IT team would normally fall back on during an incident may already be untrustworthy. Recovering from a breach is considerably harder when the recovery source is the thing that was breached. For small businesses and home users running a single QNAP unit as both production storage and archive, that is the sharpest takeaway from this alert.
Practical steps for QNAP owners
For users running QNAP NAS units at home or in the office, the response path is straightforward:
- Update Plex Media Server now — open QNAP App Center, find Plex Media Server, and install the current version QNAP is distributing there. Do not sideload an installer from elsewhere.
- Check QNAP's advisory — read the vendor's official security notice for affected versions and any indicators of compromise, and confirm your installed build against it.
- Isolate if you suspect compromise — if the device shows unexpected processes, unknown admin accounts, or unexplained outbound traffic, disconnect it from the network before investigating, so an attacker cannot use it as a springboard.
- Audit your other apps — review every third-party package installed from App Center for pending updates, since each one carries its own patch cadence.
- Verify your backups are actually usable — confirm that copies stored elsewhere (a separate disk or cloud target) date from before any suspected compromise and can be restored.
QNAP's own advisory page is where the affected and fixed version numbers, along with any indicators of compromise, are published — and it should be checked both before and after any update is applied.
The broader lesson for anyone running network storage is that the appliance boundary has blurred into something closer to a fiction. Storage, apps, and backup all sit on the same box, which means data integrity depends as much on the third-party software catalogue as on the firmware QNAP ships — a standing reason to treat App Center updates as part of the regular patch-review routine, not an afterthought to firmware maintenance.
QNAP 發出警告，指攻擊者正透過 Plex Media Server 的一系列漏洞入侵其網絡儲存設備，並呼籲用戶立即從官方 App Center 安裝該應用程式的最新版本。
是次警示涉及一組名為 Plex2Shell 的漏洞鏈，QNAP 表示該漏洞鏈已在野外被用於攻擊 NAS 裝置。公司對用戶的指示十分明確：應從 QNAP App Center 取得最新版本的 Plex Media Server，切勿使用舊版本或另行下載的安裝程式。
今次披露之所以重要，在於漏洞程式碼實際所在的位置。Plex Media Server 並非 QNAP 自家技術堆疊的一部分，而是透過廠商應用程式生態系分發的第三方應用程式，並按自身的修補時間表運行。即使管理員準時更新 NAS 固件，只要其上層的應用程式更新滯後，仍然可能暴露於風險之中。現今的 NAS 越來越不像一個封閉的獨立裝置，反而更接近一個小型應用程式平台，隨之而來的是種種修補管理的複雜性。
第三方應用程式，而非 QNAP 自家程式碼
這種模式對 QNAP 用戶而言並非陌生。該公司的裝置一直以來都是勒索軟件營運者的反覆目標：2021 年的 Qlocker 透過濫用 QNAP 的 HybridBackup Sync 加密用戶的存檔；2022 年的 DeadBolt 則接踵而至，先攻擊裝有 Multimedia Streaming Add-on 的系統，其後更直指 QTS 本身。Plex2Shell 以另一扇門延續了這段歷史——這次是由應用程式而非作業系統所打開的。
為何備份層面才是最嚴重的問題
最具後果性的風險，出現在 NAS 同時充當機構備份目的地之時。一旦攻擊者在儲存裝置上站穩腳跟，IT 團隊在事故中通常依賴的副本可能已經不可信。當恢復的來源本身就是遭入侵的對象時，從入侵中恢復將困難得多。對於以單一 QNAP 裝置同時作為生產儲存和存檔用途的中小企業及家庭用戶而言，這是今次警示最關鍵的啟示。
QNAP 用戶的實務處理步驟
對於在家中或辦公室使用 QNAP NAS 裝置的用戶，應對步驟相當直接：
- 立即更新 Plex Media Server —— 開啟 QNAP App Center，找到 Plex Media Server，安裝 QNAP 現正分發的最新版本。切勿從其他來源側載安裝程式。
- 查閱 QNAP 的安全通告 —— 閱讀廠商的官方安全通知，了解受影響版本及任何入侵指標（indicators of compromise），並核對已安裝的版本。
- 如懷疑已遭入侵，先作隔離 —— 如裝置出現異常執行的程序、不明管理員帳戶或無法解釋的對外流量，應在調查前將其斷開網絡連接，防止攻擊者利用它作跳板。
- 審核其他應用程式 —— 檢查從 App Center 安裝的每一個第三方套件是否有待更新項目，因為每個套件各有其修補節奏。
- 驗證備份確實可用 —— 確認儲存於其他位置（另一硬碟或雲端目標）的副本日期早於任何懷疑入侵的時間，且可以正常還原。
QNAP 自身的通告頁面刊載了受影響及已修補的版本號碼，以及任何入侵指標，不論更新前或更新後均應查閱。
對所有網絡儲存用戶而言，更廣泛的教訓是：所謂「裝置邊界」已模糊至近乎虛構。儲存、應用程式和備份全部位於同一部機器上，這意味著數據完整性不僅取決於 QNAP 出廠的固件，同樣取決於第三方軟件目錄——這正是應將 App Center 更新納入定期修補檢視流程、而非於固件維護後才考慮的常設理由。