CVE-2021-33959

HIGH

Plex Media Server < 1.21 - Denial of Service via DDOS Reflection Attack

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-33959. PoCs published by lixiang957.

AI-analyzed exploit summary This repository provides a functional proof-of-concept for CVE-2021-33959, demonstrating a UDP-based SSRF vulnerability in Plex Media Server. The exploit sends an M-SEARCH HTTP request to specific UDP ports (32410, 32414) to trigger the vulnerability.

Description

Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service.

Exploits (1)

nomisec WORKING POC 1 stars
by lixiang957 · poc
https://github.com/lixiang957/CVE-2021-33959

This repository provides a functional proof-of-concept for CVE-2021-33959, demonstrating a UDP-based SSRF vulnerability in Plex Media Server. The exploit sends an M-SEARCH HTTP request to specific UDP ports (32410, 32414) to trigger the vulnerability.

Classification
Working Poc 80%
Attack Type
Ssrf
Complexity
Trivial
Reliability
Reliable
Target: Plex Media Server < 1.21
No auth needed
Prerequisites: Network access to the target Plex Media Server
mistral-large-3 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Third Party Advisory
https://github.com/lixiang957/CVE-2021-33959
Exploit, Technical Description, Third Party Advisory
https://www.freebuf.com/articles/web/260338.html

Scores

CVSS v3 7.5
EPSS 0.1504
EPSS Percentile 96.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-346
Status published
Products (1)
plex/media_server < 1.21
Published Jan 18, 2023
Tracked Since Feb 18, 2026