Windows 11 USB Plug and Play Flaw Lets Attackers Chain to SYSTEM Takeover

Security researchers Alejandro Hernando and Borja Martinez have demonstrated how Windows 11's Plug and Play (PnP) auto-installation can be weaponized into a SYSTEM-level compromise, in research presented at DEF CON 34 under the title "Plug And Pwn: Weaponizing Windows PnP Auto-Install." The technique abuses the legitimate driver-selection process documented by Microsoft, in which Windows matches hardware and compatible IDs to signed vendor driver packages. By emulating devices that map to real, signed vendor software, the researchers showed that an unprivileged user can steer PnP into loading privileged installation components that were never intended to be touched by low-rights code. The full exploitation chain was validated on a fully updated Windows 11 machine.

The physical chain begins by emulating a Sierra Wireless modem, prompting Windows to install SwiService.exe—which runs as a SYSTEM service and exposes a SetDNS primitive. The attacker uses that primitive to redirect DNS resolution, then emulates a Sony FeliCa reader whose co-installer pulls configuration files over plaintext HTTP and derives local filenames directly from URL paths. A path-traversal flaw in that flow lets the co-installer drop a malicious DLL into System32; reconnecting the emulated Sierra device then loads the planted DLL and yields SYSTEM code execution. The unencrypted HTTP retrieval step is a reminder that firmware and driver update channels still routinely trust cleartext endpoints—auditors can validate exposure with an SSL/TLS checker and confirm name-server behavior with a DNS leak test.

The remote variant eliminates the need for physical hardware. The researchers' Python client forges a USB identity and presents a phantom Intel RealSense device over RDP, where supported Plug and Play or low-level USB redirection is enabled. Windows follows the redirected installation path, drops RealSense software into a user-writable directory, and the attacker abuses a CRYPTBASE.dll search-order hijack to escalate from an authenticated low-privilege user to SYSTEM. Microsoft notes that Remote Desktop Services does not allow supported Plug and Play or RemoteFX USB redirection by default, and that low-level USB forwarding requires Plug and Play redirection to be explicitly enabled—meaning the remote path is configuration-dependent, not a default Windows exposure. Administrators operating RDS hosts can verify the attack surface with a port scanner and apply device-installation restrictions that allow or block devices by hardware ID, compatible ID, device-instance ID, or setup class, which also apply to redirected devices on a Remote Desktop server.