Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11
DEF CON researchers chained Windows Plug and Play auto-install abuse with third-party driver flaws to reach SYSTEM on fully updated Windows 11.
In 'Plug And Pwn' research prepared for DEF CON 34, Alejandro Hernando and Borja Martinez emulated USB devices so Windows auto-installed signed vendor software, chaining a Sierra Wireless SwiService.exe SetDNS primitive, a Sony FeliCa co-installer path-traversal flaw that writes a DLL into System32, and device reconnection for SYSTEM code execution. A remote variant over Remote Desktop forges a synthetic Intel RealSense device and abuses a CRYPTBASE.dll search-order hijack when PnP or low-level USB redirection is enabled. Microsoft notes RDP does not allow supported PnP and RemoteFX USB redirection by default, and no in-the-wild exploitation has been reported.
- Physical chain: emulated Sierra device installs SwiService.exe; Sony FeliCa co-installer path traversal drops DLL in System32
- Remote chain: synthetic USB over RDP presents phantom Intel RealSense device; CRYPTBASE.dll hijack yields SYSTEM
- Requires attacker-controlled USB device or enabled PnP/low-level USB redirection over RDP
- Microsoft device-installation restriction policies can block the redirected install path by hardware ID
- Organizations
- DEF CON
From the original article
2 min read at thehackernews.com
Swati Khandelwal Aug 11, 2026 Vulnerability / Enterprise Security Windows Plug and Play can be abused to fetch signed vendor software for an emulated USB device and execute privileged installation components that researchers chained to SYSTEM access on a fully updated Windows 11 machine.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.