Remote RDP Can Exploit PnP for Full System Takeover

Researchers found a new attack vector that lets an attacker abuse Windows 11’s Plug‑and‑Play feature to fetch signed vendor software from an emulated USB device and execute privileged installation components chained to SYSTEM access on a fully updated machine. ¹

The same Plug‑and‑Play path can be triggered over Remote Desktop without physical hardware when low‑level redirection is enabled, expanding the reach beyond local networks. ¹

Microsoft states that it has not yet issued a patch but acknowledges the issue and advises users to review their driver signing policies. ¹

This attack leverages Microsoft’s inherent trust in signed drivers; similar vulnerabilities were exploited with rogue Thunderbolt devices back in 2017 (BadUSB), but this PnP bypass over Remote Desktop significantly expands potential targets beyond physical access. Expect penetration testers to immediately test RDP security configurations for Plug‑and‑Play permissions. The core issue isn’t just about malicious hardware—it highlights how driver signing can be abused if not carefully audited by system administrators who often lack time or resources.

Full SYSTEM takeover means attackers can install malware, exfiltrate data, elevate privileges, and maintain persistence across reboots, effectively compromising user privacy and corporate confidentiality. Organizations should disable unnecessary device redirection in Remote Desktop sessions, enforce least privilege on Plug‑and‑Play installations, and monitor for anomalous installation activity.

The discovery shows that even fully updated Windows 11 remains vulnerable due to its supply‑chain trust model, underscoring the need for tighter auditing of signed drivers and stricter controls around low‑level USB redirection. Security teams must update their monitoring tools to detect unauthorized PnP activity before it leads to a full system compromise.