Port 32400 – Plex Media Server (Media Streaming Web UI & Remote-Access API)

Port 32400 is the default TCP port for Plex Media Server, the self-hosted platform that streams a personal media library — movies, TV, music, and photos — to clients on the local network and, when remote access is enabled, across the internet. Everything Plex exposes lives here: the web dashboard at http://<host>:32400/web, the full HTTP/XML API used by every Plex client, and the unauthenticated http://<host>:32400/identity endpoint that returns the server’s machineIdentifier and version. So an open port 32400 almost always means a Plex server, and the first questions are whether it’s reachable from the internet, whether the API is answering without a token, and what version it’s admitting to.

Why It’s Open

Plex Media Server binds 32400/TCP on start-up and keeps it open for the lifetime of the process. It’s open because someone is running Plex — on a NAS, a home server, a spare PC, or a cloud VM — and wants to reach their library from a phone, a smart TV, a browser, or the Plex apps. When a user enables Remote Access, Plex tries to punch a hole through the router (via UPnP or NAT-PMP) so 32400 is reachable from outside the LAN, and it also relays through plex.tv. That convenience is exactly what puts thousands of Plex servers directly on the public internet, often without the owner realising the port is exposed rather than relayed. On a home connection an open 32400 is a media server someone deliberately opened up; on a cloud host it can be a personal library, a shared community server, or a forgotten install nobody has patched in years.

Common Risks

• Internet-exposed server with weak or no authentication. Plex supports LAN connections that bypass sign-in, and misconfigured “allow on local network without auth” settings or open relays can let anyone browse libraries, pull media, or hit the admin API without a token.
• Version and identity fingerprinting. The /identity endpoint returns the server’s machineIdentifier, version, and platform without any authentication — a free fingerprint that tells an attacker exactly which Plex CVEs to try.
• Outdated, unpatched builds. Plex Media Server has shipped real remote-code-execution, XXE, and path-traversal bugs (see CVEs below). A server that hasn’t auto-updated — the LastPass breach turned on exactly this — is a direct compromise target.
• UDP amplification / reflection abuse (a sibling UDP port, not 32400 itself). Plex’s GDM (G’Day Mate) discovery responder on UDP 32410 and 32414 was abused from 2020 onward as a reflection/amplification DDoS vector. This is a distinct problem from the 32400 TCP web port, but the same exposed host is usually the source — see the Real-World Example.
• Information disclosure. Beyond version, a reachable server can leak library names, media metadata, device names, and the IP addresses of connected clients.
• Network pivot. Enabling UPnP/NAT-PMP for remote access opens router pinholes automatically, expanding the attack surface and, if the Plex host is on a flat home or corporate network, offering a foothold into everything else.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Confirm it’s Plex, pull the version, then test whether the API answers without authentication.

Detect the service and version

nmap -sV -p 32400 <target>

Read the identity endpoint (unauthenticated fingerprint)

curl -s http://<target>:32400/identity

This returns a MediaContainer with machineIdentifier, version, and platform details — no token required. It’s the single fastest way to fingerprint the exact build so you can match it to the CVEs below.

Check the web dashboard and API headers

curl -sI http://<target>:32400/web/index.html
curl -s http://<target>:32400/ | head

Look for X-Plex-Protocol, X-Plex-Content-Original-Length, and a Server: banner confirming Plex, plus whether /web serves the dashboard to anonymous visitors.

Test for unauthenticated API access

curl -s "http://<target>:32400/library/sections"
curl -s "http://<target>:32400/status/sessions"

A healthy server answers these with 401 / Unauthorized unless you supply a valid X-Plex-Token. If library sections, active sessions, or account data come back without a token, the server is exposing its API to anyone.

Probe the GDM discovery responder (UDP sibling ports)

nmap -sU -sV -p 32410,32412,32413,32414 <target>

An open UDP 32410/32414 that answers GDM probes is the reflection/amplification surface — flag it separately from the 32400 web port.

Exploit an unpatched Windows server (authenticated RCE)

msfconsole -q
use exploit/windows/http/plex_unpickle_dict_rce
set RHOSTS <target>
set PLEX_TOKEN <token>
run

This module weaponises CVE-2020-5741 — the authenticated Python pickle deserialization RCE tied to the LastPass breach; it needs a valid Plex token.

Record every open port 32400, the exact version from /identity, and any endpoint that answered without a token, so the evidence lands in the pentest report instead of a scratch terminal you’ll lose.

What to Look For

Known CVEs and Exploits

Fingerprint the exact build from /identity first — every one of these is version-specific, and a fully updated Plex Media Server is not affected by them.

• CVE-2020-5741 — Deserialization of untrusted data in Plex Media Server on Windows before 1.19.3. A remote, authenticated attacker (admin/token required) creates a photo library, drops a malicious Dict file, points LocalAppDataPath at it, and Plex unpickles the file into arbitrary Python code execution. CVSS 7.2. It’s in CISA’s Known Exploited Vulnerabilities catalog, weaponised in Metasploit as exploit/windows/http/plex_unpickle_dict_rce, and is the exact bug abused in the 2022 LastPass breach.
• CVE-2020-5740 — Improper input validation in Plex Media Server on Windows before 1.19.2.2673. A local, unauthenticated attacker executes arbitrary Python code with SYSTEM privileges via an uncontrolled search-path element. CVSS 7.8. A local privilege-escalation companion to the RCE above.
• CVE-2019-19141 — Path traversal in the Camera Upload feature of Plex Media Server through 1.18.2.2029. A remote, authenticated user writes files anywhere the Plex account can, which escalates to RCE — for example, dropping an authorized_keys file into the plex user’s .ssh directory on Linux and logging in over SSH. CVSS 8.8.
• CVE-2018-13415 — XML External Entity (XXE) processing in the SSDP/UPnP XML parser of Plex Media Server 1.13.2.5154. An unauthenticated attacker on the local network reads arbitrary files, captures NetNTLM credentials, or executes commands in Windows domains via a malicious device descriptor. CVSS 9.8. Public PoC: Exploit-DB 45146.

Corrections to the previous version of this page. The old stub described CVE-2020-5741 as “unauthenticated API access and info leak” — it is actually an authenticated Python deserialization RCE, corrected above. It labelled CVE-2018-13415 a “directory traversal” bug — it is an XXE flaw, also corrected. And it cited “Exploit-DB 44423” as a Plex subtitle-parsing RCE; Exploit-DB 44423 is actually a GoldWave 5.70 buffer overflow with nothing to do with Plex, so it has been removed. As always, verify every CVE against its NVD record and scope it to the real product before trusting it.

Mitigation

• Don’t expose 32400 to the internet. If you don’t need remote streaming, turn off Remote Access in Plex settings and firewall 32400/TCP to the LAN or a VPN. Prefer reaching Plex over a VPN or the plex.tv relay rather than a direct router pinhole.
• Keep Plex Media Server updated. Enable automatic updates and confirm the running build via /identity — the CVEs above are all fixed in current releases, and an unpatched server is the LastPass lesson in one sentence.
• Require sign-in for every client. Disable “allow connections without authentication” / insecure-LAN settings so no path reaches the API without a valid Plex token, and never leave the dashboard open to anonymous visitors.
• Disable UPnP/NAT-PMP on the router so Plex can’t silently open ports, and block/rate-limit the GDM responder on UDP 32410–32414 to remove the reflection/amplification surface.
• Isolate the host. Run Plex as an unprivileged user, keep it off flat networks with sensitive systems, and — for anything genuinely internet-facing — front it with a reverse proxy enforcing TLS on 443 (or an alternative HTTPS port like 8443) instead of publishing raw plaintext 32400, and never re-expose it on a soft HTTP-alternate port such as 8080.
• Rescan to confirm. After locking it down, re-run nmap -p 32400 <host> from outside the network to verify the port is no longer reachable.

Real-World Example

The 2022 LastPass breach is the definitive port-32400 cautionary tale. After compromising a LastPass developer’s corporate laptop in the first stage, the attackers pivoted to a second stage against one of only four DevOps engineers with vault-decryption access. That engineer ran Plex Media Server on a home computer, and the build was more than two years out of date — still vulnerable to CVE-2020-5741, the authenticated Python deserialization RCE Plex had patched back in May 2020. The attackers exploited it to run code on the machine, installed a keylogger, and captured the engineer’s LastPass master password, ultimately exfiltrating encrypted customer vaults and metadata for millions of users. CISA added CVE-2020-5741 to its Known Exploited Vulnerabilities catalog in the aftermath. Separately, from late 2020 Plex servers were abused as a reflection/amplification DDoS vector: NETSCOUT’s ASERT found more than 27,000 exposed Plex GDM responders answering SSDP-style probes on UDP 32414/32410, with an amplification factor of roughly 4.68:1 feeding attacks that reached into the tens of Gbps and beyond. Two very different abuses, one root cause — an internet-exposed, unattended Plex install.

FAQ

What is port 32400 used for?

Port 32400 is the default TCP port for Plex Media Server. It hosts the web dashboard (/web), the HTTP/XML API every Plex client uses to browse and stream media, and remote-access connections. If it’s open, a Plex server is almost certainly running and reachable at http://<host>:32400.

Is it safe to leave port 32400 open to the internet?

Not by default. An internet-exposed Plex server is only as safe as its patch level and authentication settings — outdated builds have real RCE, XXE, and path-traversal bugs, and misconfigured LAN-auth settings can hand out API access without a token. Prefer VPN or the plex.tv relay, keep Plex updated, and firewall 32400 to trusted networks.

What does the /identity endpoint reveal?

http://<host>:32400/identity returns the server’s machineIdentifier, version, and platform with no authentication. That version string lets anyone match the server against known Plex CVEs, which is why exposing 32400 to the internet gives attackers a free fingerprint.

Is port 32400 the one used in Plex DDoS amplification attacks?

No — that’s a different, UDP, sibling. The reflection/amplification abuse targets Plex’s GDM discovery responder on UDP 32410 and 32414, not the 32400 TCP web port. The same exposed host is usually the source, so an internet-facing Plex install is a risk on both fronts.

How was Plex involved in the LastPass breach?

An attacker exploited an unpatched Plex Media Server (CVE-2020-5741) on a LastPass engineer’s home computer to run code and install a keylogger, capturing the master password that unlocked LastPass’s decryption keys. It’s the best-documented example of why an out-of-date, exposed Plex server matters.

How do I secure or close port 32400?

Disable Remote Access if you don’t need it, turn off router UPnP/NAT-PMP, require Plex sign-in for all clients, keep the server auto-updated, and firewall 32400/TCP (plus GDM on UDP 32410–32414) to the LAN or a VPN. Rescan from outside with nmap -p 32400 <host> to confirm it’s closed.

TL;DR

• Service: Plex Media Server — web UI (/web), HTTP/XML API, and remote-access endpoint on 32400/TCP; /identity leaks version and machineIdentifier unauthenticated
• Default port: 32400/TCP (GDM discovery responder on UDP 32410/32414 is a separate, abusable sibling)
• Biggest risk: an internet-exposed, outdated Plex server — RCE via CVE-2020-5741 (the LastPass breach), plus XXE and path-traversal bugs — or unauthenticated API access on a misconfigured install
• Mitigation: keep Plex updated, disable Remote Access/UPnP if unneeded, require sign-in for all clients, firewall 32400 (and UDP 32410–32414) to LAN/VPN, and rescan to confirm