{"id":2640,"date":"2026-09-02T08:39:40","date_gmt":"2026-09-02T08:39:40","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2640"},"modified":"2026-09-02T08:39:40","modified_gmt":"2026-09-02T08:39:40","slug":"researchers-use-claude-to-port-pre-auth-rce-exploit-from-one-plc-model-to-another","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2640","title":{"rendered":"Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another"},"content":{"rendered":"
\n
<\/a><\/div>\n

Forescout Research – Vedere Labs said it used Anthropic’s Claude to port a working pre-authentication remote code execution (RCE) exploit from one WAGO programmable logic controller (PLC) to another, executing attacker-supplied ARM shellcode on live hardware.<\/p>\n

The exploit targets CVE-2021-31886<\/strong>, a stack-based buffer overflow in the Nucleus FTP server’s handling of the USER command, which carries a Siemens-assigned CVSS score of 9.8 and is accessible before authentication over TCP port 21.<\/p>\n

CERT@VDE says no updates are available for the affected WAGO controllers, and advises owners to disable or block FTP on port 21, enforce segmentation controls, and monitor network traffic for anomalies.<\/p>\n

The port required sustained researcher steering, and the final RCE development stage consumed $535.74 in application programming interface (API) usage over an 8-hour-32-minute session.<\/p>\n

A later session that attempted to extend the exploit into a command-and-control (C2) implant wrote to a flash-mapped memory region, permanently bricking the PLC.<\/p>\n

\u00abOne could argue that the same researcher could have achieved the initial RCE port without AI in less time and at lower cost while also keeping the PLC alive,\u00bb Forescout said.<\/p>\n

Vedere Labs had previously developed a working RCE exploit for the WAGO 750-852, and ported that exploit<\/a> to a WAGO 750-831 running firmware V01.04.16.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The researchers supplied the existing 750-852 exploit, a firmware binary for the 750-831, and a physical 750-831 as the live target. Each stage ran as interactive sessions between a researcher and Claude Code, which had access to a terminal, the reverse-engineering tool Ghidra, and the target PLC.<\/p>\n

<\/p>\n

The work began on Claude Sonnet 4.6 and moved to Claude Opus 4.6 after the initial RCE attempts stalled. Normal FTP processing on the 750-831 zeroed 256 bytes at the attacker-controlled buffer, so the injected shellcode was overwritten before it could run.<\/p>\n

Claude adapted the USER and QUIT sequence used against the 750-852 into a USER and CWD sequence. Omitting the CRLF terminator then \u00abprevented the relevant processing path from completing in the usual way,\u00bb Forescout said. The buffer survived long enough for the payload to execute.<\/p>\n

Once code execution was established, the model moved from working no-operation (NOP) shellcode to two functional payloads in 12 minutes, Forescout said. One sent ICMP echo requests to an attacker-controlled system, and the other sent a UDP packet containing the string PWNED.<\/p>\n

The exploit runs in the Ethernet receive callback context, and the demonstrated capability stops at the point of sending network packets.<\/p>\n

\"\"<\/a><\/div>\n

Vedere Labs has previously shown that RCE on a controller can be chained to enable deep lateral movement in operational technology (OT) networks, exploiting multiple vulnerabilities in Schneider Electric Modicon PLCs.<\/p>\n

Forescout said the model also flagged a potential bug in the FTP command extraction loop, distinct from CVE-2021-31886, during the first session.<\/p>\n

Manual review \u00absuggested that this may be a separate, previously unidentified, vulnerability,\u00bb Forescout said. The team set it aside for separate investigation, and the issue carries no CVE identifier.<\/p>\n

A GitHub repository search for CVE-2021-31886<\/strong>, run by The Hacker News on September 1, returned no results, and the flaw is absent from Exploit-DB and Packet Storm. That search indexes repository names and descriptions rather than file contents.<\/p>\n

\u00abThe more immediate risk is not an agent independently deciding to attack a controller, but an authorized agent taking the wrong action on a physical system where failure has real operational consequences,\u00bb Forescout said.<\/p>\n

The CERT@VDE advisory for WAGO<\/a> lists the following devices as vulnerable to all the flaws in that advisory, including CVE-2021-31886 –<\/p>\n