Claude AI Creates Pre-Auth RCE Exploit for WAGO PLCs

Key Takeaways

• AI successfully assisted in porting a pre-authentication Remote Code Execution (RCE) exploit for WAGO PLCs.
• The exploit targeted CVE-2021-31886, a buffer overflow in the Nucleus FTP server, allowing arbitrary ARM shellcode execution.
• While successful, the process required significant human intervention, substantial API costs, and ultimately rendered the test device inoperable.
• The findings underscore AI’s potential in OT exploitation but highlight the continued necessity of human expertise and the inherent risks of AI-driven testing on cyber-physical systems.

Cybersecurity researchers leveraged Anthropic’s Claude AI to port a pre-authentication remote code execution (RCE) exploit to a WAGO programmable logic controller (PLC). This experiment demonstrates the evolving role of artificial intelligence in facilitating low-level operational technology (OT) exploitation, even on embedded systems.

The successful proof-of-concept allowed for arbitrary ARM shellcode execution on a WAGO 750-831 PLC without requiring valid authentication credentials. However, the endeavor was far from fully autonomous, demanding extensive human oversight, incurring significant API usage costs, and ultimately resulting in the permanent malfunction of the test device.

Targeting a Known Vulnerability

The exploit specifically targeted CVE-2021-31886, a buffer overflow vulnerability residing within the Nucleus FTP server, a component found in numerous embedded products. This flaw stems from the FTP service’s failure to adequately validate the length of a username supplied via the USER command.

By crafting an excessively long username, an attacker can overwrite memory regions and redirect program execution. The Forescout researchers focused their efforts on a WAGO 750-831 PLC running firmware version V01.04.16. A working exploit for the related WAGO 750-852 model already existed, providing a foundation for the new target.

AI’s Role in Adaptation

Claude AI was instrumental in identifying the target-specific memory addresses, function offsets, callback locations, and regions suitable for shellcode storage on the new device. Unlike typical web or application exploitation scenarios, this PLC test involved a closed-source embedded system, precluding access to a debugger, which significantly complicated the reverse engineering process.

Claude Code utilized a suite of tools, including firmware analysis utilities, Ghidra, generated Python scripts, and network testing tools, to inspect the firmware and interact with the live controller. Nevertheless, the AI initially veered down incorrect code paths, produced invalid exploit attempts, and necessitated researchers to provide detailed disassembly information and actively guide the analysis.

Overcoming Exploitation Challenges

The first tangible outcome was a system crash, confirming the buffer overflow could be triggered. Achieving reliable RCE, however, presented a more formidable challenge. Forescout researchers found that the normal FTP command processing routine cleared the attacker-controlled buffer after the USER command was handled, preventing the injected ARM shellcode from persisting long enough to execute.

Claude identified a method to preserve the payload by altering the FTP command sequence. Instead of the standard USER followed by QUIT, the successful approach involved a USER followed by a CWD sequence, crucially omitting the CRLF command terminator. This deviation prevented the normal completion path from clearing the memory buffer.

Once the buffer preservation issue was resolved, Claude rapidly generated functional payloads. One such payload caused the PLC to transmit ICMP echo requests to an attacker-controlled system, while another sent a UDP packet containing the text “PWNED.” The exploit required network access to FTP port 21 but bypassed authentication requirements because the vulnerable USER command is processed prior to login.

The final stage of RCE development incurred an API usage cost of $535.74 and spanned 8 hours and 32 minutes across multiple research sessions. A significant portion of this effort involved reverse-engineering the FTP processing chain to understand why the shellcode was being overwritten.

Risks and Implications

Researchers subsequently attempted to evolve the proof-of-concept into a command-and-control implant. During memory probing and payload testing, an AI-generated payload inadvertently wrote to flash-mapped memory, rendering the PLC permanently inoperable.

This incident vividly illustrates the inherent safety risks associated with autonomous or semi-autonomous testing against critical cyber-physical devices. The findings confirm that AI can indeed assist in adapting embedded exploits across similar OT targets, though specialized human expertise remains indispensable for navigating the complexities and mitigating potential damage.

What You Should Do

• Restrict Network Exposure: Limit unnecessary exposure of FTP and remote management interfaces on PLCs and other OT devices to the internet and internal networks.
• Implement Network Segmentation: Isolate OT networks from IT networks to contain potential breaches and prevent lateral movement.
• Monitor for Anomalous Behavior: Actively monitor PLCs for unexpected crashes, unusual outbound network traffic (e.g., ICMP echo requests to external IPs), and any deviations from baseline operations.
• Patch and Update Firmware: Ensure all OT devices, especially those with embedded FTP servers, are running the latest firmware versions to address known vulnerabilities like CVE-2021-31886.
• Assess “Difficult” OT Flaws: Re-evaluate the potential impact of seemingly difficult-to-exploit OT vulnerabilities, as AI tools can significantly reduce the effort required for exploit development, increasing their practical threat level.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.