Researchers Use Claude to Port a Pre-Auth RCE Exploit Between WAGO PLCs

What Happened

Researchers at Forescout Research — Vedere Labs used Anthropic's Claude to port a working pre-authentication remote code execution (RCE) exploit from one WAGO programmable logic controller (PLC) model to another, ultimately achieving arbitrary ARM shellcode execution on live industrial hardware. The exercise is one of the clearest public demonstrations yet of an AI model doing the technical exploit-adaptation work that previously required a specialist vulnerability researcher.

The underlying bug is CVE-2021-31886, a stack-based buffer overflow in the USER command handling of the Nucleus FTP server embedded in WAGO's controller firmware. It carries a CVSS score of 9.8 and is reachable pre-authentication over TCP port 21.

From One Controller to Another

Forescout already had a functioning exploit for the WAGO 750-852 PLC. The question was whether that exploit could be adapted to a different model — the WAGO 750-831, running firmware V01.04.16 — without a human doing the reverse-engineering by hand.

The researchers handed Claude three inputs:

• The existing, working 750-852 exploit
• The 750-831 firmware binary
• Physical access to a 750-831 unit for live testing

Work began on Claude Sonnet 4.6 and moved to Claude Opus 4.6 once initial attempts stalled. The key adaptation Claude made was changing the FTP command sequence from USER/QUIT to USER/CWD, and dropping the CRLF terminator that would otherwise have overwritten the buffer it needed intact. Once reliable code execution was established, functional payloads followed quickly — Forescout reported working proof-of-concept payloads within 12 minutes, including one that sent ICMP echo requests and another that transmitted a UDP packet containing the string "PWNED."

A follow-up session in which Claude attempted to build a persistent C2 implant went further than intended: writing to flash-mapped memory on the device permanently bricked it.

Why This Matters for ICS/OT

Forescout was careful to frame the risk correctly. As the researchers put it, "the more immediate risk is not an agent independently deciding to attack a controller, but an authorized agent taking the wrong action on a physical system where failure has real operational consequences." In other words, the danger isn't a rogue autonomous AI hunting for PLCs to attack — it's that the same capability that let Claude adapt an exploit safely in a lab can just as easily be pointed at production infrastructure by a human operator, and can just as easily misfire and destroy hardware, as the bricked 750-831 demonstrates.

The result lines up with recent warnings from the NSA, CISA, FBI, and EPA about AI-generated exploit tooling being used against internet-exposed Siemens S7-series PLCs and other ICS equipment. What used to require days of manual reverse engineering by a specialist can now be substantially automated — dramatically lowering the skill and time barrier for adapting a known exploit to a new but related target.

Affected Devices

CERT@VDE's advisory for the underlying Nucleus RTOS vulnerability lists multiple WAGO controller families running Nucleus V1 RTOS with firmware 16 and earlier:

• 750-829, 750-831, 750-852, 750-880, 750-881, 750-882, 750-885, 750-889
• 750-331, 750-352

No firmware update is currently available for the affected line.

Recommendations

CERT@VDE's guidance for operators running affected WAGO controllers:

1. Disable or block FTP on port 21 at the device and network level
2. Enforce network segmentation so ICS/OT devices are not reachable from IT networks or the internet
3. Monitor network traffic for anomalous FTP activity and unexpected connections to controller management ports
4. Inventory affected models (750-829/831/852/880/881/882/885/889, 750-331/352) and prioritize isolation until firmware updates ship

References

• The Hacker News — Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

Related Reading

• Critical Langflow Flaw Exploited to Steal OpenAI and AWS Keys
• Anthropic's Claude Mythos Finds Thousands of Zero-Day Flaws Across Major Systems
• AI Slashes Cyberattack Exploit Timelines From Years to Days