Reported by 3 outlets

Timeline

1. original reporting

   Plug & Pwn Attack Abuses Windows Plug and Play to Gain SYSTEM Privileges

   cyberpress.org · 63d ago · August 11th, 2026

   A newly disclosed “Plug & Pwn,” is a set of attack chains that weaponize Windows Plug and Play (PnP) driver installation to execute vendor-supplied code as NT AUTHORITY\SYSTEM. Plugandpwn demonstrates how an attacker can abuse trusted device-driver packages delivered through Windows Update without administrator rights, user interaction, or, in certain scenarios, physical USB hardware. The core issue is not a flaw in USB enumeration itself. Instead, the researchers argue that Windows PnP becomes a privileged delivery mechanism when it automatically resolves a connected device’s hardware identifiers, downloads a matching signed driver package, and runs installation components as SYSTEM. New Plug & Pwn Attack Abuses Windows Plug and Play A malicious actor can emulate a device with a targeted vendor ID and product ID, causing Windows to install vulnerable or logically insecure vendor software. In the physical “Plug & Pwn” proof of concept, a Linux attack machine using FaceDancer hardware emulates Sierra Wireless and Sony devices against a fully patched Windows 11 system with no active user session. zero-click physical chain (Source:plugandpwn) The Sierra component installs a SYSTEM service that exposes a named pipe writable by Everyone. Through the pipe, an attacker can invoke a DNS-setting function and redirect the victim’s DNS traffic. The chain then emulates a Sony FeliCa device. Its signed co-installer fetches configuration files over unencrypted HTTP and derives

2. update from gbhackers.com

   Plug & Pwn Attack Exploits Windows PnP to Gain SYSTEM Access With Zero Clicks

   gbhackers.com · 63d ago · August 11th, 2026

   Security researchers Alejandro Hernando, also known as 0xedh, and Borja Martínez have unveiled a research project titled “Plug & Pwn.” This project demonstrates how the Windows Plug and Play (PnP) driver installation workflows can be exploited to execute vendor-supplied code with NT AUTHORITY\SYSTEM privileges. Presented at DEF CON 34, the research explores the risky intersection […] The post Plug & Pwn Attack Exploits Windows PnP to Gain SYSTEM Access With Zero Clicks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from bleepingcomputer.com

   Plug and Pwn attack uses fake USB devices for Windows SYSTEM access

   bleepingcomputer.com · 62d ago · August 12th, 2026

   By using software to emulate USB devices, the researchers found they could force Windows to install signed vendor packages containing exploitable components or weaknesses that can be abused to gain SYSTEM privileges. Some of the demonstrated attacks require no user interaction or logged-in user, while another can be performed remotely over RDP without any physical USB hardware being connected to the targeted computer. plugandpwn.com . Abusing Windows Plug and Play Windows supports a feature called co-installers , which automatically downloads and installs vendor software and drivers when a new USB device is inserted into a computer. In 2021, BleepingComputer reported on how this feature was abused along with a Razer Synapse vulnerability to give a standard Windows user SYSTEM privileges simply by plugging in a Razer mouse or keyboard. A flaw in the installer allowed