Windows Plug and Play can be abused to fetch signed vendor software for an emulated USB device and execute privileged installation components that researchers chained to SYSTEM access on a fully updated Windows 11 machine.

The same PnP path can be triggered over Remote Desktop without physical hardware when supported Plug and Play or low-level USB redirection is enabled; Microsoft says that redirection is not allowed by default.

Security researchers Alejandro Hernando and Borja Martinez described the technique in “Plug And Pwn: Weaponizing Windows PnP Auto-Install,” research prepared for DEF CON 34.