Plug and Pwn attacks exploit the Windows Plug and Play mechanism by presenting maliciously crafted fake USB devices. When connected, Windows automatically installs vendor software that may be vulnerable or insecure, allowing privilege escalation to SYSTEM level. This attack targets the automatic driver installation process without requiring user interaction beyond connecting the device. The disclosed information does not specify affected Windows versions or available patches. The attack highlights risks associated with automatic device driver installations triggered by USB connections.

Successful exploitation results in an attacker obtaining SYSTEM privileges on the Windows host, which grants full control over the system. This level of access can allow installation of persistent malware, data theft, or further network compromise. The attack vector requires physical or logical connection of a malicious USB device to the target system. There is no current evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official fixes or mitigations are available, organizations should consider restricting USB device usage, disabling automatic driver installation where feasible, and implementing device control policies to prevent unauthorized USB devices. Monitoring for suspicious USB device activity may also help detect attempts to exploit this attack vector.