Critical Windows PnP Vulnerability Lets Attackers Gain SYSTEM Access

Key Takeaways

• A new attack, “Plug and Pwn,” leverages vulnerabilities within the Windows Plug and Play (PnP) driver installation process to achieve SYSTEM-level access.
• The technique exploits how Windows identifies, downloads, and installs hardware drivers, rather than a kernel zero-day, affecting Windows 11 and potentially other versions.
• Both local (physical USB access) and remote (RDP USB redirection) attack vectors exist, enabling privilege escalation even before user logon or within VDI environments.
• The research highlights the need for robust security beyond signed drivers, emphasizing restricted USB access, careful RDP configuration, and thorough review of vendor software components.

Cybersecurity researchers Alejandro Hernando and Borja Martínez have unveiled a critical attack vector dubbed “Plug and Pwn,” demonstrating how an attacker can achieve NT AUTHORITYSYSTEM privileges on a Windows machine by manipulating the operating system’s Plug and Play (PnP) driver installation mechanism. This sophisticated technique does not rely on exploiting a zero-day vulnerability in the Windows kernel but rather on abusing the standard processes Windows employs to detect new hardware, locate appropriate vendor driver packages, download them, and execute installation components with elevated SYSTEM rights.

The researchers indicate that this vulnerability can be triggered simply by connecting a USB device to a Windows 11 computer, even when no user is actively logged in. This highlights a significant risk, as physical access alone could lead to full system compromise.

An attacker can simulate a specific device identity using a tool like FaceDancer. This action prompts Windows to identify and resolve the corresponding driver package, subsequently initiating vendor-supplied code within a highly privileged installation context.

Their physical proof-of-concept (PoC) demonstrates this by chaining existing weaknesses found in Sierra Wireless and Sony FeliCa software. Initially, a Sierra service operating with SYSTEM privileges exposes a named pipe, allowing for broad access. The researchers exploit this primitive to alter the target system’s DNS server configuration.

Following this, they emulate a Sony device, whose co-installer retrieves configuration data over an unencrypted HTTP connection. By redirecting the Sony domain to an attacker-controlled server, they are able to supply specially crafted files. These files ultimately lead to arbitrary file write operations with SYSTEM privileges.

A malicious DLL is then strategically placed in the Windows System32 directory. This DLL is subsequently loaded by the Sierra component, enabling SYSTEM code execution even before a user logs into the system.

Remote Attack Vector: NoPlug and Pwn

Plug and Pwn also describes a remote attack variant named “NoPlug and Pwn.” This method specifically targets environments where RDP USB redirection is intentionally enabled, a common configuration in some Virtual Desktop Infrastructure (VDI) deployments.

A standard RDP user can transmit forged USB descriptors over the URBDRC channel, tricking the remote host into enumerating a device that does not physically exist. As an illustration, the project uses an Intel RealSense driver package. Its installer reportedly launches an executable from a directory that is writable by standard users, enabling DLL sideloading when the installation process runs as SYSTEM.

PNP Simulate Tool Released

To assist in understanding and mitigating these vulnerabilities, the researchers have also released PNP Simulate. This tool facilitates the examination of the driver discovery and installation path without requiring actual physical hardware. It functions by creating a root enumerated device, assigning USB hardware IDs, querying package availability, and can optionally force the device into the installation workflow.

Their extensive testing has revealed a crucial distinction: while Windows Update metadata might identify numerous matching driver packages, only a smaller subset is deemed eligible for automatic Plug and Play installation. This insight is vital for understanding the scope of potential exploits.

Another demonstration combines Wacom and Atheros packages. The Atheros service can execute attacker-influenced registry operations as SYSTEM. Conversely, a Wacom service contains a registry-controlled path that can launch a command shell with SYSTEM privileges. The final exploit chain utilizes a malicious print monitor DLL, loaded by the Windows Print Spooler after a system reboot, to bridge these two behaviors and achieve SYSTEM execution.

This research underscores a critical point: relying solely on signed drivers and trusted update channels is insufficient for comprehensive security. Enterprises must implement additional layers of defense to mitigate these sophisticated attacks.

What You Should Do

• Limit USB Device Exposure: Restrict the use of unknown or unauthorized USB devices on corporate machines. Implement USB device control policies where feasible.
• Disable RDP USB Redirection: Turn off RDP USB redirection in environments where it is not strictly necessary, especially within VDI deployments.
• Restrict Driver Installation: Implement policies that prevent standard users from installing drivers. Review and tighten driver installation permissions.
• Monitor Driver Package Downloads: Implement robust monitoring for unexpected or unauthorized driver package downloads and installations.
• Review Vendor Installers: Conduct thorough security reviews of vendor installers, services, co-installers, and any privileged registry operations performed by third-party software.
• Assess VDI Systems: Microsoft administrators should pay particular attention to VDI systems with USB redirection enabled, as these configurations can expose a privileged Plug and Play attack path to standard remote sessions.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.