High severity · published Dec 8, 2021
CVE-2021-42835
An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee
7.0
CVSS
1.2%
EPSS
No
On KEV
Description
An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker (with a foothold in a endpoint via a low-privileged user account) can access the exposed RPC service of the update service component. This RPC functionality allows the attacker to interact with the RPC functionality and execute code from a path of his choice (local, or remote via SMB) because of a TOCTOU race condition. This code execution is in the context of the Plex update service (which runs as SYSTEM).
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
Media Server · Plex
before 1.25.0.5282 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-42835
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-42835
Third Party Advisory
https://bugsec.com/experts_teams/
Vendor Advisory
https://forums.plex.tv/t/security-regarding-cve-2021-42835/761510
Exploit
https://ir-on.io/2021/12/02/local-privilege-plexcalation/
Product
https://www.plex.tv/media-server-downloads/
More from Media Server
7.2
CVE-2026-96656
Plex Media Server arbitrary file write
7.2
CVE-2020-5741
Plex Media Server Remote Code Execution Vulnerability
6.5
CVE-2026-96654
Plex Media Server URL injection
4.3
CVE-2026-96655
Plex Media Server arbitrary-host SSRF
4.3
CVE-2026-96652
Plex Media Server SSRF