Windows PnP Attack Chain Turns a USB Plug Into SYSTEM: Details and PoC Now Public
Do Son 
TL;DR
Two Accenture researchers showed that plugging a USB device into Windows can hand an attacker SYSTEM. The chain needs no admin rights and no logged-in user. Both the vulnerability details and the proof-of-concept exploit code are now public.
Why This Windows PnP Attack Matters
At DEF CON 34, Alejandro “0xedh” Hernando and Borja “borjmz” Martinez unveiled “Plug and Pwn.” Their research targets Windows Plug and Play, the feature that auto-installs drivers.
The core problem is simple. When you plug in a USB device, Windows may fetch a signed package from Windows Update and run vendor code as SYSTEM. As the advisory puts it, this happens “with no administrator privileges and no logged-on user.”
Therefore, the classic barrier to privilege escalation falls away. The researchers put it bluntly: “PnP becomes the loader.” Because the packages are signed, the operating system trusts them without question.
How the Windows PnP Attack Works
The team chained low-severity bugs from separate vendors into one high-impact result. Individually, some vendors do not even treat these flaws as vulnerabilities.
The Physical Zero-Click Chain
First, the attacker emulates a Sierra Wireless device using a FaceDancer board. That service opens a named pipe with an “Everyone” read/write ACL, so any user can call its SetDNS function. Next, the attacker hijacks the machine’s DNS.
Then a Sony FeliCa device gets emulated. Its co-installer pulls configuration files over plaintext HTTP and trusts them. Since the DNS now points at the attacker, they become the Sony server.
A path traversal flaw in that co-installer allows an arbitrary file write as SYSTEM. The advisory describes it as “an arbitrary file write anywhere on disk, as SYSTEM, with fully attacker-controlled content.” The team aims it straight into System32 and loads a planted DLL.
The Remote RDP Variant
The attack also works without hardware. Using RDP USB redirection, a standard remote user can forge a phantom device over the network. The server trusts the descriptors the client sends and installs the driver as SYSTEM.
Affected Software and Vendors
The disclosed chains involve Sierra Wireless, Sony FeliCa, Wacom, Atheros, and Intel RealSense components. Notably, the Atheros package matched a CVE first reported in 2019, yet it still installs today.
Because these are logical bugs in signed vendor software, exact affected version counts are not published as firm figures. Any Windows system that auto-installs these vendor packages should be considered at risk.
Patch and Mitigation Steps
No single vendor patch fixes the whole chain, so defenders must reduce the attack surface. Administrators can block co-installers through Group Policy to stop PnP from running vendor software automatically.
In addition, disable RDP USB redirection where it is not needed, especially in managed VDI deployments. Review which signed vendor packages your endpoints can pull from Windows Update. Finally, monitor for unexpected driver installs on locked or unattended machines.
The researchers released their full toolkit, including FaceDancer scripts and PoC source, on their official Plug and Pwn release page. Anyone can reproduce the PnP behavior and check the primitives.
The Bottom Line
This Windows PnP attack reframes a trusted convenience feature as a privilege escalation path. Signed does not mean safe, and cryptographic trust is not the same as logical security. With details and exploit code public, defenders should act now.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
