A flaw in Windows Plug and Play (PnP) architecture allows attackers to spoof USB devices and chain the resulting driver installations into full SYSTEM-level privilege escalation on fully patched Windows 11 machines. The vulnerability carries particular weight for infrastructure operators managing Windows-based systems, especially those running remote desktop services or allowing USB device redirection.

How the Attack Works

The attack exploits PnP's automatic device driver installation mechanism. When Windows detects a new USB device, it queries vendor-specific driver repositories and automatically installs signed software packages without explicit user consent. Researchers discovered they could emulate a USB device and trick PnP into fetching and executing a legitimate vendor's signed installation components—components that run with elevated privileges by design.

By chaining these privileged installation routines through controlled parameters, an attacker gains escalation to SYSTEM access. The critical aspect is that the driver packages themselves are legitimate and signed; the vulnerability lies in how PnP invokes them and the trust model around their execution context.

Testing confirmed the attack succeeds on a fully updated Windows 11 system with all current patches applied, meaning standard patch management alone does not mitigate the issue.

Remote Exploitation over RDP

The vulnerability becomes significantly more serious when considered in remote infrastructure contexts. If a Windows server has Remote Desktop Protocol (RDP) enabled with USB device redirection or low-level Plug and Play device support enabled—common configurations in virtualized environments and remote management setups—an attacker can trigger the same exploit chain without physical USB hardware access.

This transforms a local privilege escalation into a remote code execution vulnerability for any exposed RDP session. An attacker with valid credentials to an RDP service, or one exploiting weak RDP authentication, can establish a session and trigger the PnP chain to gain SYSTEM access. For hosting providers or enterprises running Windows VPS infrastructure, this expands the attack surface significantly.

Implications for Infrastructure Operations

Infrastructure teams running Windows-based services should review their RDP and USB device redirection policies. Disabling USB redirection on remote desktop connections where not explicitly required is a straightforward mitigation. Similarly, restricting which devices are allowed to use automatic driver installation—or disabling automatic installation entirely for untrusted networks—reduces exposure.

The vulnerability highlights a broader architectural tension in Windows: automatic convenience features like PnP driver installation create trust assumptions that privilege escalation paths can exploit. This is familiar ground for security researchers, but the end-to-end chain here—from USB emulation to SYSTEM code execution—demonstrates that seemingly minor design decisions compound into high-impact vulnerabilities.

Microsoft's response has been to acknowledge the issue and recommend administrative controls rather than issuing a direct patch, suggesting the company views this as a configuration/policy problem rather than a code defect requiring immediate updates. That framing may not satisfy organisations running mission-critical Windows infrastructure.

Practical Defense Posture

Until or unless Microsoft issues a definitive patch, operators should consider:

For smaller infrastructure teams, the practical takeaway is straightforward: review your RDP and USB policies, and assume that features like automatic driver installation will be abused if an attacker gains any network access to your Windows systems.