Plug and Pwn: Windows PnP Flaw Allows Remote SYSTEM Takeover

Security researchers Alejandro Hernando and Borja Martínez have disclosed a novel attack vector dubbed "Plug and Pwn" that enables full system takeover on Windows 11. By abusing the Windows Plug and Play (PnP) subsystem, attackers can force the operating system to automatically download and execute privileged, vendor-signed software packages, granting arbitrary code execution under NT AUTHORITY\SYSTEM privileges.

The attack exploits the PnP subsystem's standard workflow, which uses Vendor IDs (VID) and Product IDs (PID) to automatically identify hardware and fetch corresponding drivers from Windows Update servers. In a physical proof-of-concept, the researchers used a FaceDancer device to emulate specific hardware. They successfully chained a Sierra Wireless named pipe exposure via a "SetDns" command with a Sony FeliCa co-installer's plaintext HTTP retrieval to achieve a SYSTEM-level file write. Beyond Sony and Sierra Wireless, the researchers identified similar privileged logic flaws in driver packages from Wacom, which allowed for an interactive SYSTEM shell, and Atheros, which permitted arbitrary registry operations.

The Trust Gap in Code Signing

Windows Plug and Play is designed for seamless hardware integration, relying on the assumption that signed drivers are inherently safe. However, this research highlights a critical blind spot: while the code itself is digitally signed by the vendor, the logic within the installers—known as co-installers—may contain severe vulnerabilities. These can include insecure network communications or DLL search-order hijacking, which allow attackers to bypass the security boundaries that code signing is intended to protect.

Implications for Remote Infrastructure

While the attack can be performed physically, its most significant risk lies in its remote application. The researchers demonstrated that the exploit can be executed over Remote Desktop Protocol (RDP) by passing synthetic USB descriptors across the URBDRC virtual channel. This triggers the driver auto-installation process on the target server without requiring physical access. This capability poses a substantial risk to Virtual Desktop Infrastructure (VDI) and Remote Desktop Services (RDS) environments, where USB redirection is frequently enabled to allow users to access local peripherals.

Moving Toward PnP Auditing

As Hernando and Martínez noted, "digital code signing alone does not guarantee a secure execution boundary." The discovery proves that SYSTEM-level access can be achieved without relying on traditional memory-corruption bugs, instead leveraging the intended logic of the OS and trusted third-party vendors. To help organizations identify similar risks, the researchers have released a utility called PNPsimulate, designed for auditing PnP discovery and installation sequences. Security teams are now encouraged to evaluate their RDP configurations and the trust levels assigned to automated driver installations.