Forescout Research – Vedere Labs said it used Anthropic’s Claude to port a working pre-authentication remote code execution (RCE) exploit from one WAGO programmable logic controller (PLC) to another, executing attacker-supplied ARM shellcode on live hardware.
The exploit targets CVE-2021-31886, a stack-based buffer overflow in the Nucleus FTP server’s handling of the USER command, which carries a Siemens-assigned CVSS score of 9.8 and is accessible before authentication over TCP port 21.
CERT@VDE says no updates are available for the affected WAGO controllers, and advises owners to disable or block FTP on port 21, enforce segmentation controls, and monitor network traffic for anomalies.
The port required sustained researcher steering, and the final RCE development stage consumed $535.74 in application programming interface (API) usage over an 8-hour-32-minute session.
A later session that attempted to extend the exploit into a command-and-control (C2) implant wrote to a flash-mapped memory region, permanently bricking the PLC.
“One could argue that the same researcher could have achieved the initial RCE port without AI in less time and at lower cost while also keeping the PLC alive,” Forescout said.
Vedere Labs had previously developed a working RCE exploit for the WAGO 750-852, and ported that exploit to a WAGO 750-831 running firmware V01.04.16.
The researchers supplied the existing 750-852 exploit, a firmware binary for the 750-831, and a physical 750-831 as the live target. Each stage ran as interactive sessions between a researcher and Claude Code, which had access to a terminal, the reverse-engineering tool Ghidra, and the target PLC.
The work began on Claude Sonnet 4.6 and moved to Claude Opus 4.6 after the initial RCE attempts stalled. Normal FTP processing on the 750-831 zeroed 256 bytes at the attacker-controlled buffer, so the injected shellcode was overwritten before it could run.
Claude adapted the USER and QUIT sequence used against the 750-852 into a USER and CWD sequence. Omitting the CRLF terminator then “prevented the relevant processing path from completing in the usual way,” Forescout said. The buffer survived long enough for the payload to execute.
Once code execution was established, the model moved from working no-operation (NOP) shellcode to two functional payloads in 12 minutes, Forescout said. One sent ICMP echo requests to an attacker-controlled system, and the other sent a UDP packet containing the string PWNED.
The exploit runs in the Ethernet receive callback context, and the demonstrated capability stops at the point of sending network packets.
Vedere Labs has previously shown that RCE on a controller can be chained to enable deep lateral movement in operational technology (OT) networks, exploiting multiple vulnerabilities in Schneider Electric Modicon PLCs.
Forescout said the model also flagged a potential bug in the FTP command extraction loop, distinct from CVE-2021-31886, during the first session.
Manual review “suggested that this may be a separate, previously unidentified, vulnerability,” Forescout said. The team set it aside for separate investigation, and the issue carries no CVE identifier.
A GitHub repository search for CVE-2021-31886, run by The Hacker News on September 1, returned no results, and the flaw is absent from Exploit-DB and Packet Storm. That search indexes repository names and descriptions rather than file contents.
“The more immediate risk is not an agent independently deciding to attack a controller, but an authorized agent taking the wrong action on a physical system where failure has real operational consequences,” Forescout said.
The CERT@VDE advisory for WAGO lists the following devices as vulnerable to all the flaws in that advisory, including CVE-2021-31886 –
- 750-829 (FW16 and earlier)
- 750-831/000-00x (FW14 and earlier)
- 750-852 (FW16 and earlier)
- 750-880/0xx-xxx (FW16 and earlier)
- 750-881 (FW16 and earlier)
- 750-882 (FW16 and earlier)
- 750-885/0xx-xxx (FW16 and earlier)
- 750-889 (FW16 and earlier)
- 750-331 (FW16 and earlier)
- 750-352/xxx-xxx (FW16 and earlier)
“The listed fieldbus coupler and PLCs above are based on Nucleus V1 RTOS. At the moment, there are no updates for this version available,” the advisory said.
Two of those models, the 750-882 and the 750-885/0xx-xxx, are absent from both the advisory’s mitigation section and its remediation table, leaving their fix status unstated.
Siemens, which maintains Nucleus, states in its Nucleus advisory that no remediation is planned for Nucleus NET across all versions, and that Nucleus ReadyStart V3 releases from V2013.08.1 onward already fix CVE-2021-31886.
The flaw was one of 13 disclosed in November 2021 as NUCLEUS:13 by Forescout and Medigate. In its earlier research on chaining PLC exploits, Forescout concluded that the issues discussed “should likely not be near the top of your priority list,” and said AI advances should make organizations reconsider that risk calculus.
The research follows a joint advisory issued August 19 by the NSA, CISA, FBI, Department of Energy, and Environmental Protection Agency, which warned of an active threat to internet-exposed Siemens S7 Series PLCs from AI-generated exploitation scripts.
The agencies assess that the activity is likely intended for persistent reconnaissance and capability development and have stopped short of attribution.
Separately, the FBI and the EPA reported attacks on water utilities in at least seven states since July 27, some of which degraded operations. Those actors changed IP addresses and passwords on internet-facing Rockwell Automation MicroLogix controllers, in attacks that needed no exploit.
“Using AI to generate exploitation scripts represents an evolution in threat actor capabilities, dramatically reducing the technical expertise and time required to develop working ICS exploitation scripts and malicious tools,” the authoring agencies said in the joint advisory.
