Forescout Research - Vedere Labs demonstrated the use of Anthropic's Claude AI to port a pre-authentication remote code execution exploit from one WAGO programmable logic controller (PLC) model to another. The exploit targets CVE-2021-31886, a stack-based buffer overflow vulnerability in the Nucleus FTP server's handling of the USER command. Researchers successfully executed attacker-supplied ARM shellcode on live hardware, showcasing the potential of AI tools to accelerate exploit development and porting. This research highlights significant risks to industrial control systems and operational technology environments. The ability to leverage AI to adapt existing exploits lowers the barrier for attackers targeting critical infrastructure. WAGO PLCs are commonly used in industrial automation and critical infrastructure settings, amplifying the severity of this finding.
Forescout Research - Vedere Labs used Anthropic's Claude AI to port a pre-authentication remote code execution (RCE) exploit from a WAGO 750-852 PLC to a WAGO 750-831 running firmware V01.04.16. The exploit targets CVE-2021-31886, a stack-based buffer overflow in the Nucleus FTP server's handling of the USER command (CVSS 9.8), accessible before authentication over TCP port 21. The 750-831's FTP processing zeroed 256 bytes at the attacker-controlled buffer, overwriting injected shellcode before execution. Claude adapted the USER+QUIT FTP sequence (used against the 750-852) into a USER+CWD sequence, and omitting the CRLF terminator prevented the normal processing path from completing, allowing the buffer and shellcode payload to survive long enough to execute. Once RCE was established, Claude developed two functional ARM shellcode payloads in 12 minutes: one sending ICMP echo requests to an attacker-controlled host, and another sending a UDP packet with the string 'PWNED'. The exploit runs in the Ethernet receive callback context. The research used Claude Sonnet 4.6 initially, then Claude Opus 4.6. Tools included Ghidra for reverse engineering and a physical PLC as the live target. The final RCE development stage cost $535.74 in API usage over 8 hours 32 minutes. A subsequent session attempting to extend the exploit into a C2 implant wrote to flash-mapped memory, permanently bricking the PLC. Claude also identified a potential separate, previously unidentified vulnerability in the FTP command extraction loop during the first session. The vulnerability (CVE-2021-31886) was part of NUCLEUS:13, a set of 13 flaws disclosed in November 2021. No public PoC was found on GitHub, Exploit-DB, or Packet Storm as of September 1. A joint NSA/CISA/FBI/DOE/EPA advisory from August 19 warned of active AI-generated exploitation scripts targeting internet-exposed Siemens S7 Series PLCs. Separately, FBI and EPA reported attacks on water utilities in at least seven states since July 27 involving Rockwell Automation MicroLogix controllers.
1. Disable or block FTP on TCP port 21 on all affected WAGO PLC models as no firmware updates are available for Nucleus V1 RTOS. 2. Enforce network segmentation controls to isolate PLCs and OT networks from untrusted networks. 3. Monitor network traffic for anomalies, including unusual FTP command sequences (USER+CWD without CRLF), unexpected ICMP traffic from PLCs, and anomalous UDP packets from PLCs. 4. Remove internet exposure of all PLCs, especially Siemens S7 Series and Rockwell Automation MicroLogix controllers. 5. Change default credentials and restrict remote access to PLCs. 6. Apply patches for Siemens Nucleus ReadyStart V3: upgrade to V2013.08.1 or later to fix CVE-2021-31886. 7. Follow the joint NSA/CISA/FBI/DOE/EPA advisory (AA26-231A) recommendations for ICS/OT security. 8. Implement change monitoring for IP addresses and passwords on internet-facing PLCs. 9. Reassess risk prioritization for NUCLEUS:13 vulnerabilities in light of AI-assisted exploitation capabilities. 10. Monitor the unidentified FTP command extraction loop vulnerability flagged by Forescout for a future CVE assignment.
TCP port 21 (FTP) exploitation traffic targeting WAGO PLCs, ICMP echo requests to attacker-controlled systems from PLC, UDP packets containing the string 'PWNED' from PLC, Anomalous FTP USER and CWD command sequences without CRLF terminator
