Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another
Forescout Research/Vedere Labs used Anthropic's Claude to port a working pre-auth RCE exploit (CVE-2021-31886) from a WAGO 750-852 PLC to a different model, the 750-831, executing ARM shellcode on live hardware The exploit targets a stack-based buffer overflow in the Nucleus FTP server's USER command handling (CVSS 9.8) over unauthenticated TCP port 21, with no firmware updates available from the vendor Claude adapted the attack by switching from a USER/QUIT sequence to USER/CWD with an omitted
Analysis
TL;DR
- Forescout Research/Vedere Labs used Anthropic's Claude to port a working pre-auth RCE exploit (CVE-2021-31886) from a WAGO 750-852 PLC to a different model, the 750-831, executing ARM shellcode on live hardware
- The exploit targets a stack-based buffer overflow in the Nucleus FTP server's USER command handling (CVSS 9.8) over unauthenticated TCP port 21, with no firmware updates available from the vendor
- Claude adapted the attack by switching from a USER/QUIT sequence to USER/CWD with an omitted CRLF terminator to bypass buffer zeroing, achieving functional RCE payloads (ICMP and UDP "PWNED") within 12 minutes of initial code execution
- The session cost $535.74 in API usage over 8 hours 32 minutes, and a subsequent attempt to build a C2 implant permanently bricked the PLC by writing to flash-mapped memory
- This follows a joint NSA/CISA/FBI/DOE/EPA advisory warning of active AI-generated exploitation scripts targeting internet-exposed Siemens PLCs, signaling a broader shift in ICS threat actor capabilities
Why It Matters
This research demonstrates that AI coding agents can successfully port complex zero-day-class exploits across different hardware platforms with minimal human intervention, dramatically lowering the barrier to attacking operational technology infrastructure. For defenders, it underscores that vulnerabilities disclosed years ago in widely deployed PLCs remain actively exploitable through AI-assisted means, and that the risk calculus around unpatched OT assets must be fundamentally reconsidered.
Technical Details
- Vulnerability: CVE-2021-31886, a stack-based buffer overflow in the Nucleus FTP server's handling of the USER command on WAGO PLCs, rated CVSS 9.8, accessible pre-authentication over TCP port 21
- AI Agent Setup: Claude Code (starting with Sonnet 4.6, upgraded to Opus 4.6) was given access to a terminal, Ghidra reverse-engineering tool, the target PLC firmware binary, and the live hardware target, running interactive sessions with researcher steering
- Exploit Adaptation: The original 750-852 exploit used a USER/QUIT sequence; Claude discovered that switching to USER/CWD and omitting the CRLF terminator prevented the FTP processing path from zeroing the 256-byte attacker-controlled buffer, allowing shellcode to survive long enough to execute
- Payload Execution: Once RCE was established, Claude generated two functional payloads in 12 minutes — one sending ICMP echo requests and another sending a UDP packet containing "PWNED" — running in the Ethernet receive callback context
- Additional Findings: Claude flagged a potential second vulnerability in the FTP command extraction loop distinct from CVE-2021-31886, which manual review suggested may be a previously unidentified flaw (no CVE assigned); the exploit is absent from public repositories (Exploit-DB, Packet Storm, GitHub)
- Bricking Incident: A follow-up session attempting to extend the exploit into a C2 implant wrote to a flash-mapped memory region, permanently damaging the physical PLC
Industry Insight
- Organizations running WAGO PLCs (and other Nucleus V1 RTOS-based controllers) with internet-exposed or poorly segmented FTP services face immediate, actionable risk; until firmware updates exist, network segmentation and port 21 blocking are the only mitigations
- The AI-assisted exploit porting demonstrates that threat actors no longer need deep reverse-engineering expertise to adapt known vulnerabilities to new targets, validating government warnings about AI-amplified ICS threats and accelerating the need for proactive vulnerability management in OT environments
- The bricking incident highlights a critical operational risk: AI agents operating on physical systems can cause irreversible hardware damage, suggesting that any use of autonomous AI agents in OT contexts requires strict sandboxing, human-in-the-loop safeguards, and clear boundaries between virtual and physical system access
Disclaimer: The above content is generated by AI and is for reference only.