Claude Adapts an RCE Exploit to a WAGO PLC: ARM Shellcode Executed Without Authentication

From an Existing Exploit to Code Executed on Real Hardware

Forescout Research, through Vedere Labs, adapted a remote code execution exploit from one WAGO PLC model to another with assistance from Claude. The proof of concept worked on real hardware, enabling researcher-controlled ARM shellcode to execute without prior authentication.

The starting point was an exploit already developed for the WAGO 750-852. The porting target was instead a WAGO 750-831 running firmware V01.04.16.

Claude was provided with three components: the original exploit, the firmware binary to analyze, and the physical controller. The model could use a terminal, the Ghidra reverse-engineering tool, and interact directly with the PLC.

The sessions began with Claude Sonnet 4.6. After the initial attempts to achieve RCE stalled, the work continued with Claude Opus 4.6.

This was not an autonomous process. The researcher had to continuously guide the model, assess its results, and correct the direction of the analysis. The final phase lasted 8 hours and 32 minutes and consumed $535.74 in API costs.

Forescout also identified an aspect that reflects poorly on AI: the same researcher might have completed the initial port more quickly, at a lower cost, and without destroying the device during subsequent experiments.

CVE-2021-31886 Targets the FTP USER Command

The exploit targets CVE-2021-31886, a critical vulnerability in the FTP server of the Nucleus NET component, which is integrated into the Nucleus RTOS real-time operating system.

The flaw is a stack-based buffer overflow caused by insufficient validation of the FTP USER command length. Siemens also classifies it as CWE-170, involving improper NULL termination handling.

The vulnerability is reachable through TCP/21 before authentication. An attacker therefore does not need credentials or to persuade an operator to take any action. The vulnerability has a CVSS score of 9.8, with the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Potential consequences include denial of service and remote code execution, with possible impacts on confidentiality, integrity, and availability.

CVE-2021-31886 is one of 13 vulnerabilities collectively referred to as NUCLEUS:13, which were disclosed in November 2021. The Siemens ProductCERT advisory SSA-044112 was published on 2021-11-09 and updated to version V1.1 on 2021-12-14.

There is no indication that CVE-2021-31886 was added to CISA’s Known Exploited Vulnerabilities catalog, nor that it was subject to a federal remediation deadline. The demonstration nevertheless confirms the existence of a working exploit in a laboratory environment.

A search conducted on September 1 found no GitHub repositories identified by name or description with CVE-2021-31886. No results were found in Exploit-DB or Packet Storm either. However, checking GitHub metadata does not rule out the possibility that relevant code exists in repositories with different names.

The Critical Modification: From QUIT to CWD, Without CRLF

The port required overcoming a behavioral difference in the WAGO 750-831. During normal FTP session handling, the device cleared 256 bytes of the attacker-controlled buffer. The payload was therefore erased before it could execute.

The original exploit for the 750-852 used a sequence consisting of USER and QUIT. Claude modified the flow by replacing the second command with CWD and removing the CRLF terminator.

This combination changed the FTP server’s processing path. The request was not completed according to the usual behavior, and the buffer remained intact long enough for the payload to execute.

After the initial result, which used a simple NOP shellcode, Claude produced two ARM payloads with observable effects in 12 minutes:

1. sending ICMP echo requests to a system controlled by the researcher;
2. transmitting a UDP datagram containing the string PWNED.

The code executed in the context of the Ethernet receive callback. The test therefore demonstrates control over the execution flow and the ability to generate network traffic from the PLC.

It does not, by itself, demonstrate manipulation of the industrial process, ladder logic, or the controller’s complete application functions. That step would require additional capabilities and specific knowledge of the industrial environment.

During the analysis, Claude also identified a possible separate flaw in the FTP command extraction loop. Human review considered the existence of a distinct vulnerability plausible, but the issue has no CVE identifier and its exploitability has not been demonstrated.

Affected WAGO Devices and the Lack of Updates

The list of vulnerable products includes numerous WAGO PLCs and fieldbus couplers based on Nucleus V1 RTOS:

Device	Affected versions
WAGO 750-829	FW16 and earlier
WAGO 750-831/000-00x	FW14 and earlier
WAGO 750-852	FW16 and earlier
WAGO 750-880/0xx-xxx	FW16 and earlier
WAGO 750-881	FW16 and earlier
WAGO 750-882	FW16 and earlier
WAGO 750-885/0xx-xxx	FW16 and earlier
WAGO 750-889	FW16 and earlier
WAGO 750-331	FW16 and earlier
WAGO 750-352/xxx-xxx	FW16 and earlier

No updates are available for these products based on Nucleus V1 RTOS. There is also a documentation gap: the 750-882 and 750-885/0xx-xxx models appear among the vulnerable devices but not in the remediation table or the related mitigation section. Their remediation status is unspecified.

The situation differs for other Nucleus products. Siemens recommends updating Nucleus ReadyStart V3 to V2017.02.4 or later. For CVE-2021-31886, a fix was already included in releases V2013.08.1 and later.

For Nucleus NET, all versions are reportedly affected and no general remediation is available. Users should contact Siemens support or the Nucleus team. For Nucleus Source Code, all versions likewise require direct contact for patches and updates.

The C2 Test That Rendered the PLC Unusable

A subsequent session aimed to turn the exploit into a command-and-control implant. During the attempt, the code wrote to a memory region mapped to flash, rendering the PLC permanently unusable.

The incident highlights a significant difference between using AI agents with traditional software and interacting with physical systems. An erroneous write does not necessarily result in a recoverable crash: it can compromise firmware, persistent memory, or the operation of the equipment.

The immediate risk is therefore not limited to a model autonomously conducting an attack. Even an authorized agent guided by an operator can misinterpret a memory structure and perform irreversible actions.

At the same time, the joint AA26-231A advisory from CISA, NSA, FBI, DOE, and EPA describes an active threat targeting PLCs that is not limited to the Siemens ecosystem. The observed actors use AI-generated or AI-assisted exploitation scripts, sometimes disguised as legitimate OT monitoring tools.

Services such as Censys and ZoomEye are used to identify controllers exposed to the Internet. In the case of Siemens S7 devices, the tools combine Python with snap7.dll or python-snap7, enabling read and write operations through S7comm.

The activity, reported in the advisory on August 19, was assessed as likely focused on persistent reconnaissance and capability development. It was not attributed to a specific group.

Immediate Defenses and Network Indicators to Monitor in OT Environments

For WAGO devices without available updates, the priority measure is to disable FTP when it is not essential. Alternatively, TCP/21 should be blocked or filtered, with particular emphasis on preventing any direct exposure to the Internet.

Operators should also:

• inventory PLCs, firmware, and active services;
• segment IT, OT, and engineering workstation networks;
• restrict remote access by vendors and system integrators;
• monitor changes made outside authorized maintenance windows;
• establish recovery procedures compatible with the installed controllers;
• verify the integrity of industrial configurations and programs.

FTP traffic warrants attention to abnormally long USER requests, unusual sequences involving QUIT or CWD, and missing or manipulated CRLF terminators. ICMP requests to external hosts and UDP datagrams containing PWNED are specific indicators of the laboratory test, not of a known criminal campaign.

In Siemens S7 environments, defenders should also look for S7comm access from unauthorized hosts, sequential scans of port 102, CPU enumeration, and writes to data blocks outside approved hours. The presence of Snap7.dll or Python scripts with S7comm functionality on systems other than approved engineering workstations requires immediate investigation.

The WAGO demonstration does not prove that AI can replace an experienced researcher. It does show that a model equipped with tools, firmware, and access to the target can help turn a documented vulnerability into working code on a real PLC.