CVE-2020-5741
HIGH KEVPlex Media Server - Code Injection
Title source: llmDescription
Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.
Exploits (1)
metasploit
WORKING POC
NORMAL
by h00die, Chris Lyne · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/plex_unpickle_dict_rce.rb
References (3)
Scores
CVSS v3
7.2
EPSS
0.3839
EPSS Percentile
97.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitation Intel
CISA KEV
2023-03-10
VulnCheck KEV
2023-02-27
InTheWild.io
2023-03-10
ENISA EUVD
EUVD-2020-26900
Classification
CWE
CWE-502
Status
published
Affected Products (1)
plex/media_server
< 1.19.3
Timeline
Published
May 08, 2020
KEV Added
Mar 10, 2023
Tracked Since
Feb 18, 2026