Affected Systems

All Windows systems (including fully patched Windows 11) that support Plug and Play device installation. Specific vulnerable vendor packages include Sierra Wireless and Sony FeliCa software. Attack vectors include physical USB emulation and remote RDP USB redirection (no physical hardware required).

Exploitation Status

Proof-of-concept demonstrated at DEF CON 34 (August 2026). Researchers successfully achieved zero-click SYSTEM privilege escalation in ~5 minutes on fully updated Windows 11. Attack requires specialized hardware (FaceDancer with Cynthion/GreatFET) or RDP access. No evidence of active in-the-wild exploitation reported.

Business Impact

Attackers with physical access or RDP connectivity can escalate to SYSTEM privileges without user interaction or logged-in sessions. The attack chain abuses legitimate signed vendor software installed via Windows Plug and Play co-installers. Some variants require no user clicks and work on locked systems. RDP-based "NoPlug & Pwn" variant enables remote exploitation without physical USB devices. This affects enterprise environments using RDP, kiosks, and any Windows endpoints with USB ports.

Urgency

🟡 Within a week

Recommended Actions

  • Disable Windows co-installer functionality via Group Policy: Set 'Turn off Windows Update device driver search prompt' to Enabled and configure 'Prevent installation of devices using drivers that match these device setup classes' for high-risk device classes
  • Restrict RDP USB redirection in enterprise environments by disabling the 'usbdevicestoredirect' parameter in RDP client configurations and via Group Policy
  • Uninstall or block installation of Sierra Wireless and Sony FeliCa software packages identified in the attack chain; audit other vendor software installed via Plug and Play for similar vulnerabilities
  • Implement physical USB port controls: disable unused USB ports via BIOS/UEFI, deploy USB device whitelisting solutions (e.g., Microsoft Defender Application Control with USB device rules), and restrict physical access to endpoints
  • Monitor Windows event logs for unexpected device installation events (Event ID 20001, 20003 in Microsoft-Windows-UserPnp/DeviceInstall) and unusual SYSTEM-level process creation following device enumeration