Full Report
Windows Plug and Play can be abused to fetch signed vendor software for an emulated USB device and execute privileged installation components that researchers chained to SYSTEM access on a fully updated Windows 11 machine. The same PnP path can be triggered over Remote Desktop without physical hardware when supported Plug and Play or low-level USB redirection is enabled; Microsoft says that
Analysis Summary
# Vulnerability: Plug and Pwn - Weaponizing Windows PnP Auto-Install
## CVE Details
- **CVE ID:** Not specifically assigned in the provided text (Focuses on a chain of third-party driver vulnerabilities: Sierra Wireless, Sony, and Intel).
- **CVSS Score:** N/A (Researcher findings; estimated High/Critical due to SYSTEM escalation).
- **CWE:** CWE-22 (Path Traversal), CWE-427 (Uncontrolled Search Path Element), CWE-319 (Cleartext Transmission of Sensitive Information).
## Affected Systems
- **Products:** Microsoft Windows 11 (fully updated).
- **Versions:** Demonstrated on Windows 11; other versions untested but potentially susceptible to similar logic.
- **Configurations:**
- **Physical:** Access to physical USB ports.
- **Remote:** Systems with Remote Desktop Services where "Supported Plug and Play" or "Low-level USB redirection" (RemoteFX) is enabled.
## Vulnerability Description
The vulnerability leverages the Windows Plug and Play (PnP) mechanism, which automatically identifies hardware and fetches matching driver packages. Researchers chained three primary weaknesses in signed third-party vendor software triggered by emulated hardware:
1. **Service Manipulation:** Emulating a Sierra Wireless device installs a service (`SwiService.exe`) that allows an unprivileged user to redirect DNS.
2. **Path Traversal:** Emulating a Sony FeliCa reader triggers a co-installer that fetches configuration files via plaintext HTTP. By spoofing the server (via the DNS redirect), researchers use path traversal to plant a malicious DLL into `C:\Windows\System32\`.
3. **Search-Order Hijacking:** Emulating an Intel RealSense device triggers an installation process that looks for `CRYPTBASE.dll` in a user-writable directory, allowing for a DLL hijack that executes code with SYSTEM privileges.
## Exploitation
- **Status:** PoC available (Presented by researchers at DEF CON 34).
- **Complexity:** Medium (Requires emulating specific hardware identities and orchestrating a multi-stage chain).
- **Attack Vector:** Physical or Network (via RDP with redirection enabled).
## Impact
- **Confidentiality:** High (Full SYSTEM access allows reading all data).
- **Integrity:** High (Full SYSTEM access allows modifying system files and settings).
- **Availability:** High (Full SYSTEM access allows for complete system shutdown or bricking).
## Remediation
### Patches
- No specific Windows patch is currently noted, as the flaws reside in how Windows handles third-party vendor software and weaknesses within those specific signed packages (Sierra, Sony, Intel).
### Workarounds
- **Disable USB Redirection:** Ensure "Supported Plug and Play" and "RemoteFX USB Redirection" are disabled in Remote Desktop Services (default is disabled).
- **Physical Security:** Restrict physical access to USB ports on sensitive machines.
- **GPO Restrictions:** Use Group Policy to implement "Device Installation Restrictions" to block unauthorized Hardware IDs or Setup Classes.
## Detection
- **Indicators of Compromise:**
- Unexpected installation of `SwiService.exe` or Intel RealSense software on systems without that hardware.
- Unusual DNS redirection activity.
- Creation of DLLs in `System32` or user-writable installation directories by PnP processes.
- **Detection Methods:** Monitor Event Logs for `Microsoft-Windows-UserPnp` (Event ID 20001) and audit service creation/driver installation events.
## References
- [hXXps://thehackernews[.]com/2026/08/researchers-turn-usb-auto-install-into.html]
- [hXXps://plugandpwn[.]com/]
- [hXXps://learn.microsoft[.]com/en-us/azure/virtual-desktop/redirection-configure-usb]