Researchers demonstrated the Plug & Pwn attack chain, which allows code execution with NT AUTHORITY\SYSTEM privileges on a fully patched Windows 11 system without requiring user interaction or administrator privileges.
The attack exploits the Windows Plug and Play (PnP) mechanism: when a USB device is connected, Windows may automatically download a trusted driver package and execute vendor-supplied code with SYSTEM privileges. The researchers combined several vulnerabilities in third-party components, turning them into a zero-click privilege escalation chain leading to SYSTEM.
A separate NoPlug & Pwn variant was also demonstrated, in which no physical USB device is required. If USB redirection over RDP is enabled, an attacker with a standard user account can remotely emulate a device and trigger the installation of a vulnerable driver with SYSTEM privileges.
As a result, the trusted Windows driver installation mechanism can effectively be abused as a means of delivering and executing vulnerable privileged code.
Source — https://plugandpwn.com/