Researchers Use Claude to Port RCE Exploit Between WAGO PLC Models

AI-Assisted Exploit Porting

Forescout Research's Vedere Labs successfully used Anthropic's Claude to port a pre-authentication remote code execution (RCE) exploit. The exploit, targeting CVE-2021-31886, was adapted from a WAGO 750-852 programmable logic controller (PLC) to a WAGO 750-831 model. This involved executing attacker-supplied ARM shellcode on the live hardware.

Technical Details of the Exploit

The vulnerability, CVE-2021-31886, is a stack-based buffer overflow in the Nucleus FTP server's handling of the USER command, accessible before authentication on TCP port 21. It carries a Siemens-assigned CVSS score of 9.8. CERT@VDE has stated that no updates are available for the affected WAGO controllers and advises disabling or blocking FTP on port 21, enforcing segmentation controls, and monitoring network traffic.

Process and Challenges

The porting process required sustained researcher steering and consumed $535.74 in API usage over an 8-hour-32-minute session. Researchers provided Claude with the existing 750-852 exploit, firmware for the 750-831, and a physical 750-831. Claude Code had access to a terminal, Ghidra, and the target PLC. Initial attempts stalled because normal FTP processing on the 750-831 zeroed 256 bytes of the attacker-controlled buffer, overwriting the injected shellcode.

Claude adapted the USER and QUIT sequence from the 750-852 into a USER and CWD sequence for the 750-831. By omitting the CRLF terminator, the relevant processing path was prevented from completing normally, allowing the buffer to survive long enough for the payload to execute. Once code execution was established, Claude moved from working no-operation (NOP) shellcode to two functional payloads in 12 minutes: one sending ICMP echo requests and another sending a UDP packet with the string 'PWNED'.

Effectiveness and Cost Considerations

While successful, Forescout noted that a human researcher might have achieved the initial RCE port without AI in less time and at lower cost. A subsequent attempt to extend the exploit into a command-and-control (C2) implant resulted in writing to a flash-mapped memory region, permanently bricking the PLC.