PT-2020-6851 · Plex · Plex Media Server

Chris Lyne · Published 2020-05-08 · Updated 2025-11-02 · CVE-2020-5741

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Plex Media Server (affected versions not specified)

Description The issue concerns the deserialization of untrusted data in Plex Media Server, allowing a remote, authenticated attacker to execute arbitrary Python code. This can be exploited by an attacker to gain unauthorized access and execute malicious code. The vulnerability is related to the restoration of untrusted data in memory, which can lead to arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2023-01527

CVE-2020-5741

Affected Products

Plex Media Server

References · 15

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/plex_unpickle_dict_rce.rb · Exploit
• 🔥 https://tenable.com/security/research/tra-2020-32 · Exploit
• 🔥 http://packetstormsecurity.com/files/158470/Plex-Unpickle-Dict-Windows-Remote-Code-Execution.html · Exploit
• https://bdu.fstec.ru/vul/2023-01527 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5741 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5741 · Security Note
• https://forums.plex.tv/t/security-regarding-cve-2020-5741/586819 · Security Note
• https://reddit.com/r/VPNforFreedom/comments/1omc7cj/best_vpns_for_plex · Reddit Post
• https://t.me/cybersecuritytechnologies/2942 · Telegram Post
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://reddit.com/r/TechNadu/comments/1n2cuad/300k_plex_media_servers_still_vulnerable_to · Reddit Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5741 · Note
• https://t.me/cvenotify/3673 · Telegram Post
• https://t.me/cvenotify/115418 · Telegram Post
• https://t.me/cveNotify/141212 · Telegram Post