Vulnerabilities · 56 days ago

Claude ported a WAGO PLC exploit across models

Forescout’s Vedere Labs said Claude helped port a working remote code execution exploit from the WAGO 750-852 to the related 750-831, but only after more than eight hours of work, heavy human supervision, and over $500 in API usage. The exploit was originally tied to CVE-2021-31886 in the WAGO Nucleus FTP server.

The model first used firmware analysis, Ghidra, and a live device to confirm the flaw, then had to be steered away from false leads until it figured out why injected code was being wiped before execution. Once that obstacle was solved, it produced working payloads quickly, showing how much the hard part is getting to first execution and how fast adaptation can move after that.

For OT teams, the point is not a new WAGO bug; it is that a known exploit can be reworked across sibling PLCs with less manual reverse engineering than before. If your control estate uses related device families, one understood model can shorten the path to others.

CVE-2021-31886

NVD KEV

CVSS 9.8 CRITICAL: a vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All… EPSS 3% (88th percentile).

Timeline

Sep 2 Reported by The Hacker News
Sep 1 Reported by SecurityWeek

Sources

3 sources covering this story

The Hacker News Sep 2
Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another
Researcher-guided Claude ported a pre-authentication RCE exploit to a WAGO 750-831 PLC, executing ARM shellcode on live hardware.
SecurityWeek Sep 1
Experiment: Porting a PLC Exploit With AI Takes Hours and Hundreds of Dollars
Forescout researchers used Claude AI to port a remote code execution exploit between WAGO PLC models.
Cybersecurity Dive Sep 1
Frontier AI helps exploit flaws in tests using key industrial devices
A report showed that Claude could help hackers develop attack strategies targeting PLCs used by water utilities and other industries.

Entities

CVE-2021-31886

Part of the PlainSec briefing for 2026-09-03

Editions

Vulnerabilities · 56 days agoClaude ported a WAGO PLC exploit across modelsForescout’s Vedere Labs said Claude helped port a working remote code execution exploit from the WAGO 750-852 to the related 750-831, but only after more than eight hours of work, heavy human supervision, and over $500 in API usage. The exploit was originally tied to CVE-2021-31886 in the WAGO Nucleus FTP server.The model first used firmware analysis, Ghidra, and a live device to confirm the flaw, then had to be steered away from false leads until it figured out why injected code was being wiped before execution. Once that obstacle was solved, it produced working payloads quickly, showing how much the hard part is getting to first execution and how fast adaptation can move after that.For OT teams, the point is not a new WAGO bug; it is that a known exploit can be reworked across sibling PLCs with less manual reverse engineering than before. If your control estate uses related device families, one understood model can shorten the path to others.

CVE-2021-31886

NVD KEV

CVSS 9.8 CRITICAL: a vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All… EPSS 3% (88th percentile).