Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another
Forescout used Anthropic's Claude to port a working pre-auth RCE exploit for CVE-2021-31886 between WAGO PLCs, executing ARM shellcode on live hardware.
Forescout Vedere Labs used Claude interactively to port an RCE exploit for CVE-2021-31886, a CVSS 9.8 stack buffer overflow in the Nucleus FTP server's USER command, from a WAGO 750-852 to a WAGO 750-831 PLC, running attacker-supplied ARM shellcode. The final RCE stage cost $535.74 in API usage over 8 hours 32 minutes, and a follow-up attempt to build a C2 implant permanently bricked the device. CERT@VDE lists many Nucleus V1-based WAGO models as vulnerable with no updates available; Siemens plans no Nucleus NET remediation. The work follows a joint NSA/CISA/FBI/DOE/EPA advisory warning of AI-generated exploitation scripts targeting internet-exposed Siemens S7 PLCs.
- Model adapted the exploit from a USER/QUIT to a USER/CWD FTP sequence, omitting CRLF to preserve the buffer
- Functional ICMP and UDP (PWNED) payloads built within 12 minutes of achieving code execution
- Researcher-guided session also flagged a possible previously unknown bug in FTP command extraction
- GitHub, Exploit-DB and Packet Storm show no public exploit code for CVE-2021-31886
- Attacks on water utilities in at least seven states used no exploit, only changed credentials
- CVEs
- CVE-2021-31886
- Products
- GhidraNucleus RTOS
- Countries
- United States
- AI models
- Claude Sonnet 4.6Claude Opus 4.6
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-31886 | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All… | 9.8 | 3% |
From the original article
4 min read at thehackernews.com
Forescout Research - Vedere Labs said it used Anthropic's Claude to port a working pre-authentication remote code execution (RCE) exploit from one WAGO programmable logic controller (PLC) to another, executing attacker-supplied ARM shellcode on live hardware. The exploit targets CVE-2021-31886, a stack-based buffer overflow in the Nucleus FTP server's handling of the USER command
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.