{
  "port": 32400,
  "protocol": "tcp",
  "service": "Plex Media Server",
  "oneLiner": "Plex Media Server's web UI and API — someone on the network is running a media library.",
  "whatItIs": "Plex Media Server binds TCP 32400 for its web app (/web), its HTTP API, and all media streaming; the port is formally registered to Plex Inc. with IANA. It appears on scans of NAS boxes, home servers, and desktops, and Plex's remote-access feature deliberately maps it through the router via UPnP or a manual forward. An unauthenticated GET /identity returns the server's machineIdentifier and version, which is how you fingerprint one.",
  "exposure": {
    "verdict": "careful",
    "note": "Plex is designed for internet exposure with account-based auth and relays, but it has shipped pre-auth vulnerabilities (CVE-2020-5741 among them), so expose it only on a current version with remote access managed by Plex rather than a hand-rolled forward."
  },
  "checkCommand": "curl -s -m 3 http://TARGET:32400/identity",
  "links": [
    {
      "title": "IANA port registry — 32400 (Plex multimedia, registered by Plex Inc.)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=32400",
      "kind": "iana"
    },
    {
      "title": "Plex Inc. on GitHub (plexinc)",
      "url": "https://github.com/plexinc",
      "kind": "github"
    }
  ]
}