Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

Summary: Forescout's Vedere Labs used Anthropic's Claude to port a working pre-authentication RCE exploit from a WAGO 750-852 PLC to a WAGO 750-831 running firmware V01.04.16, targeting CVE-2021-31886, a stack-based buffer overflow in the Nucleus FTP server's USER command handling with a CVSS score of 9.8 and reachable over TCP port 21 before authentication. The final RCE development stage cost $535.74 in API usage over an 8-hour-32-minute session, and a later session attempting to build a command-and-control implant wrote to a flash-mapped memory region and permanently bricked the PLC.
Bottom line: CERT@VDE says no updates are available for the affected WAGO controllers, and Siemens states no remediation is planned for Nucleus NET across all versions, so the flaw cannot be patched out on these devices. Forescout's own conclusion is that the immediate risk is an authorized agent taking the wrong action on a physical system where failure has real operational consequences - a bricked controller, not a hypothetical.

Read the original at The Hacker News ↗

Mentions: CVE-2021-31886