As reported by The Hacker News, Forescout's Vedere Labs successfully used Anthropic's Claude to port a pre-authentication remote code execution exploit from one WAGO programmable logic controller model to another, executing attacker-supplied ARM shellcode on live hardware. The underlying vulnerability — CVE-2021-31886 — remains unpatched, and the demonstration raises important questions about both OT exposure and the emerging role of AI in offensive security research.
Vulnerability Profile
| Field | Detail |
|---|---|
| CVE | CVE-2021-31886 |
| CVSS | 9.8 (Critical) — Siemens-assigned |
| Type | Stack-based buffer overflow in Nucleus FTP server (USER command handling) |
| Access Vector | Network, pre-authentication, TCP port 21 |
| Affected Products | WAGO PLCs including 750-852 and 750-831 (firmware V01.04.16); potentially other WAGO controllers running Nucleus FTP |
| Patch Status | No update available per CERT@VDE |
| Active Exploitation | Not confirmed in the wild; however, functional PoC now demonstrated on live hardware |
| Vendor Advisory | CERT@VDE advisory — mitigation only |
Why This Matters
The most pressing takeaway is not the AI angle — it is that a CVSS 9.8 pre-auth RCE in industrial controllers has no patch three years after assignment. WAGO PLCs are deployed in building automation, energy, and manufacturing environments where replacement cycles are measured in decades, not quarters. If FTP is reachable on port 21 from any network segment an attacker can traverse, the controller is effectively compromised on contact.
The AI dimension is secondary but worth examining honestly. Forescout itself noted that a skilled researcher could likely have completed the port faster and at lower cost without AI assistance — the exercise consumed $535.74 in API calls over roughly eight and a half hours and ended with a bricked PLC when the model attempted to write a C2 implant to flash-mapped memory. What AI did here was lower the persistence barrier: it iterated through buffer-survival problems (adapting a USER/QUIT sequence to USER/CWD without a CRLF terminator) until the shellcode executed. That is not a breakthrough. It is a workflow augmentation that may matter more for less experienced actors than for elite researchers.
The real risk multiplier is not AI sophistication — it is the combination of unpatched critical vulnerabilities, exposed legacy services, and flat OT networks that have persisted for years.
Who Is at Risk
Shield53 Recommendations
Immediate Actions
- Disable FTP entirely on all WAGO PLCs. If FTP is operationally required, restrict it to a dedicated engineering VLAN with host-based allowlisting — never expose port 21 to shared network segments.
- Block TCP port 21 at segmentation firewalls between OT zones and any upstream network. Validate rules with active port scans from the IT side.
- Inventory all WAGO controllers in the environment. Record model, firmware version, and exposed services. The 750-831 on firmware V01.04.16 is confirmed vulnerable; treat all 750-series devices running Nucleus FTP as suspect until verified.
- Deploy network-level monitoring for FTP traffic to or from PLC subnets. Any USER command exceeding normal credential length is a strong indicator of exploitation attempts against this buffer overflow.
Strategic Actions
- Accelerate controller replacement planning for end-of-life WAGO models. Where replacement is not feasible, implement compensating controls per NIST SP 800-82 Rev. 3 guidance for legacy OT assets.
- Enforce strict Purdue Model segmentation — PLCs should reside in Level 0/1 with no direct path to Level 3 or above. Jump hosts with MFA and session recording should be the only access path.
- Establish a vulnerability-to-mitigation SLA for OT assets that accounts for the reality that patches may never arrive. Compensating control deployment should have a 30-day target from advisory publication.
- Brief OT engineers on this specific threat — not just security staff. The people who can physically observe a controller behaving abnormally are your fastest detection layer.
The AI-assisted exploit port will grab headlines, but defenders should not lose sight of the fundamentals: a critical, unpatched, pre-authentication RCE in industrial controllers demands network-level containment today. The threat actor who ultimately exploits this in the wild is unlikely to need an LLM — they will need nothing more than a reachable FTP port.
