CVE-2020-5741

Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.

Score

CVSS 3.1 7.2 High

Status

Analyzed - vulnreport@tenable.com

Published

2020-05-08

Last modified

2025-10-21

Known exploited (CISA KEV)

since 2023-03-10, action due 2023-03-31: Apply updates per vendor instructions.

Weaknesses

CWE-502

Affected products

• Media Server (Plex)

References

• http://packetstormsecurity.com/files/158470/Plex-Unpickle-Dict-Windows-Remote-Code-Execution.html
• https://www.tenable.com/security/research/tra-2020-32
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5741