Researchers Use Claude to Port Pre-Auth RCE Exploit Between WAGO PLCs

Summary

Forescout's Vedere Labs used Anthropic's Claude to port a working pre-authentication remote code execution (RCE) exploit for a WAGO programmable logic controller (PLC) to another PLC model, executing attacker-supplied ARM shellcode on live hardware. The exploit targets CVE-2021-31886 (CVSS 9.8), a stack-based buffer overflow in the Nucleus FTP server's USER command handling, reachable pre-authentication over TCP port 21.

Key Facts

• AI-assisted exploitation: The port required sustained researcher steering — US$535.74 in API usage over an 8.5-hour session.
• Demonstration: Executed attacker-supplied ARM shellcode on live hardware; a later attempt to extend the exploit into a C2 implant wrote to a flash-mapped region and permanently bricked the PLC.
• Patch status: CERT@VDE says no updates are available for the affected WAGO controllers; advises disabling or blocking FTP on port 21, enforcing segmentation and monitoring for anomalies.

Significance

This is a concrete OT demonstration that frontier AI can lower the skill floor for exploit porting — the same capability theme the Financial Stability Board flagged as the financial system's most immediate AI-driven cyber risk.

Related Pages

• Cve 2021 31886 — the WAGO Nucleus FTP vulnerability exploited

Source

• The Hacker News — Researchers Use Claude to Port Pre-Auth RCE Exploit Between WAGO PLCs