CVE-2018-13415

CRITICAL

Plex Media Server 1.13.2.5154 - Unauthenticated XML External Entity Injection via SSDP/UPnP Parser

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-13415. PoCs published by Chris Moberly.

AI-analyzed exploit summary This exploit demonstrates an Out-of-Band XXE vulnerability in Plex Media Server's SSDP processing, allowing unauthenticated attackers on the same LAN to access arbitrary files, capture NetNTLM challenge/response, or achieve remote command execution via SMB relay attacks.

Description

In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same permission as the user account running Plex, (2) Initiate SMB connections to capture a NetNTLM challenge/response and crack to cleartext password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Execution in Windows domains.

Exploits (1)

exploitdb WORKING POC

by Chris Moberly · textwebappsxml

https://www.exploit-db.com/exploits/45146

View Code ZIP pw:eip

This exploit demonstrates an Out-of-Band XXE vulnerability in Plex Media Server's SSDP processing, allowing unauthenticated attackers on the same LAN to access arbitrary files, capture NetNTLM challenge/response, or achieve remote command execution via SMB relay attacks.

Classification

Working Poc 100%

Attack Type

Info Leak

Complexity

Moderate

Reliability

Reliable

Target: Plex Media Server 1.13.2.5154 (and likely older versions)

No auth needed

Prerequisites: Network access to the target's LAN · Plex Media Server running on the target · evil-ssdp tool or similar for crafting malicious SSDP responses

MITRE ATT&CK

T1195.002 - Compromise Software Supply Chain T1005 - Data from Local System T1040 - Network Sniffing

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Core References

Exploit, Technical Description, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/45146/

Exploit, Mailing List, Technical Description, Third Party Advisory mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2018/Aug/1

Scores

CVSS v3 9.8

EPSS 0.3181

EPSS Percentile 98.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-611

Status published

Products (1)

plex/media_server 1.13.2.5154

Published Aug 13, 2018

Tracked Since Feb 18, 2026