Loading...

Plug & Pwn: Gaining SYSTEM Privileges via Windows Plug and Play AI

11.08.2026 22:25 | 185

Researchers demonstrated the Plug & Pwn attack chain, which allows code execution with NT AUTHORITY\SYSTEM privileges on a fully patched Windows 11 system without requiring user interaction or administrator privileges.

The attack exploits the Windows Plug and Play (PnP) mechanism: when a USB device is connected, Windows may automatically download a trusted driver package and execute vendor-supplied code with SYSTEM privileges. The researchers combined several vulnerabilities in third-party components, turning them into a zero-click privilege escalation chain leading to SYSTEM.

A separate NoPlug & Pwn variant was also demonstrated, in which no physical USB device is required. If USB redirection over RDP is enabled, an attacker with a standard user account can remotely emulate a device and trigger the installation of a vulnerable driver with SYSTEM privileges.

As a result, the trusted Windows driver installation mechanism can effectively be abused as a means of delivering and executing vulnerable privileged code.

Source — https://plugandpwn.com/

SOCpedia - knowledge platform

This section contains materials on SOC and Blue Team practices: articles, news, books, and translations.