Researchers at Forescout Research - Vedere Labs have demonstrated a security scenario that should get the attention of both operational technology teams and AI governance leaders: a researcher-guided Claude Code session was used to adapt a pre-authentication remote code execution exploit from one WAGO programmable logic controller model to another. The work targeted CVE-2021-31886, a critical stack-based buffer overflow in the Nucleus FTP server’s handling of the USER command, and resulted in attacker-supplied ARM shellcode running on live PLC hardware.

This is not a story about an AI agent autonomously deciding to compromise industrial equipment. It is a more practical warning. Skilled operators can use modern coding agents as accelerators for reverse engineering, exploit adaptation, debugging and payload testing. In industrial environments, where old firmware and unsupported embedded components often remain in production for years, that acceleration changes the risk calculation.

What happened

Forescout’s team had previously built a working exploit for a WAGO 750-852 controller. In the new research, they supplied Claude Code with that exploit, firmware for a WAGO 750-831 running firmware V01.04.16, access to reverse-engineering tooling such as Ghidra, terminal access and a physical PLC target. The model-assisted workflow then attempted to port the exploit to the different controller model.

According to the reporting, the vulnerability is reachable before authentication over FTP on TCP port 21 and has a Siemens-assigned CVSS score of 9.8. The affected Nucleus FTP server mishandles the USER command in a way that can trigger a stack-based overflow. The important operational detail is that this is a network-facing bug in a service that may still be enabled for engineering convenience.

The port was not a push-button success. Researchers had to guide the process over multiple interactive sessions, and the final remote code execution phase reportedly consumed more than eight hours of API-driven work. The team also moved between Claude model variants after initial attempts stalled. That nuance matters: current AI systems still need expertise, constraints and validation. But they can help experienced researchers move quickly through tedious adaptation work.

Why the exploit adaptation matters

Exploit portability is often where defenders underestimate attacker economics. A vulnerability may be known, but an exploit may appear to apply only to a specific model, firmware branch or memory layout. In OT networks, that uncertainty can delay remediation because operators assume their exact asset is not exposed in the same way.

This research challenges that comfort. The model helped adapt the command sequence and payload behavior when the first approach failed on the new target. Normal FTP processing on the WAGO 750-831 reportedly cleared the attacker-controlled buffer before shellcode could run. The workflow then shifted away from the original USER and QUIT sequence used on the prior model and toward a USER and CWD sequence, with command termination behavior adjusted so the payload survived long enough to execute.

The demonstrated payloads were intentionally limited. Forescout reported network-signaling shellcode, including ICMP echo behavior and a UDP packet containing a proof-of-execution string. Even so, code execution inside a PLC’s network receive context is a serious boundary crossing. In a real intrusion, RCE on a controller may be used as a stepping stone for persistence, manipulation of process logic, reconnaissance or lateral movement in poorly segmented OT networks.

A warning for AI-assisted security testing

The research also highlights the danger of applying agentic tooling directly to physical systems. A later attempt to extend the work toward command-and-control functionality reportedly wrote to flash-mapped memory and permanently bricked the PLC. That outcome is a useful reminder: industrial devices are not disposable cloud instances. Unsafe testing can create real operational downtime, equipment damage or safety risk.

Organizations experimenting with AI-assisted vulnerability research should separate lab targets from production assets, use recovery procedures and spare hardware, and require human approval before any action that writes to firmware, flash, configuration memory or process-control logic. Logging, prompt capture and change control should be part of the test plan, not an afterthought.

Defensive priorities for WAGO and similar PLC environments

The practical takeaway for defenders is straightforward: treat legacy FTP on industrial controllers as an emergency exposure, not a routine hardening item. CERT@VDE reportedly states that no updates are currently available for affected WAGO controllers based on the Nucleus V1 RTOS. That makes compensating controls essential.

Start by inventorying WAGO fieldbus controllers and PLCs, especially older 750-series devices. Confirm firmware versions and identify whether FTP is enabled. If FTP is not absolutely required, disable it. If it must remain available for maintenance, restrict access to dedicated engineering workstations through firewall policy and jump-host controls. TCP port 21 should not be reachable from general corporate networks, remote access pools, vendor VPN segments or the internet.

Network segmentation should be validated rather than assumed. OT firewalls should explicitly limit engineering protocols between zones, and any exceptions should have a named owner, business justification and expiration date. Passive monitoring can help detect unusual FTP commands, repeated USER attempts, unexpected CWD sequences, ICMP signals from controllers or outbound UDP traffic that does not match normal plant behavior.

Asset owners should also review incident response plans for PLC compromise scenarios. Backups of controller configuration and logic should be current, offline and restorable. Teams should know how to isolate a controller, rebuild it, validate process safety and return it to service without improvising during an incident.

Bigger picture

The headline risk is not simply “AI can write exploits.” The more useful lesson is that AI-assisted workflows can compress the time needed to adapt known vulnerability knowledge to nearby targets. For legacy OT environments, that increases pressure to remove unnecessary services, enforce segmentation and monitor for exploitation paths that were previously considered too specialized or expensive.

Security teams should treat this as a practical advisory: review exposed FTP services on industrial controllers, prioritize unsupported firmware, and ensure AI-enabled research is governed by strict lab safety controls. The combination of critical pre-authentication bugs, aging embedded stacks and increasingly capable coding agents is not theoretical anymore.

Source: The Hacker News source