"The final RCE development stage consumed $535.74 in API usage over an 8-hour-32-minute session."
CVE-2021-31886 and the affected WAGO controllers
The exploit at the center of this research targets CVE-2021-31886, a stack-based buffer overflow in the Nucleus FTP server's handling of the USER command. Siemens assigned the flaw a CVSS score of 9.8 and the vulnerability is reachable prior to authentication over TCP port 21. CERT@VDE lists a set of WAGO fieldbus couplers and PLCs based on Nucleus V1 RTOS as vulnerable; the advisory names these models and firmware thresholds as affected:
- 750-829 (FW16 and earlier)
- 750-831/000-00x (FW14 and earlier)
- 750-852 (FW16 and earlier)
- 750-880/0xx-xxx (FW16 and earlier)
- 750-881 (FW16 and earlier)
- 750-882 (FW16 and earlier)
- 750-885/0xx-xxx (FW16 and earlier)
- 750-889 (FW16 and earlier)
- 750-331 (FW16 and earlier)
- 750-352/xxx-xxx (FW16 and earlier)
The advisory states there are currently no updates for this Nucleus V1 RTOS line. Two models — the 750-882 and the 750-885/0xx-xxx — are listed among affected devices but are absent from both the advisory's mitigation section and its remediation table.
How Vedere Labs used Claude to port a working RCE
Forescout Research - Vedere Labs supplied an existing working remote code execution (RCE) exploit for a WAGO 750-852 and then used Anthropic's Claude to port that exploit to a WAGO 750-831 running firmware V01.04.16. Each stage ran as interactive sessions between a researcher and Claude Code, which had access to a terminal, the reverse-engineering tool Ghidra, and the live 750-831 hardware.
The work began on Claude Sonnet 4.6 and moved to Claude Opus 4.6 after initial attempts stalled. Normal FTP processing on the 750-831 zeroed 256 bytes at the attacker-controlled buffer so the injected shellcode was overwritten before it could execute. Claude adapted the original USER and QUIT sequence used against the 750-852 into a USER and CWD sequence and omitted the CRLF terminator; that omission, Forescout said, "prevented the relevant processing path from completing in the usual way" so the buffer survived long enough for payload execution.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadDemonstrated payloads, limits of the exploit, and a bricked PLC
Once code execution was established, the model moved from no-operation shellcode to two functional payloads in 12 minutes. One payload sent ICMP echo requests to an attacker-controlled system; the other sent a UDP packet containing the string "PWNED." Forescout notes the exploit runs in the Ethernet receive callback context and the demonstrated capability stops at the point of sending network packets.
A later Claude session that attempted to progress the exploit into a command-and-control (C2) implant wrote to a flash-mapped memory region and permanently bricked the PLC. Forescout observed that "One could argue that the same researcher could have achieved the initial RCE port without AI in less time and at lower cost while also keeping the PLC alive."
During the first session Claude also flagged a potential bug in the FTP command extraction loop, distinct from CVE-2021-31886. Manual review suggested this issue "may be a separate, previously unidentified, vulnerability"; the team set it aside for separate investigation and it carries no CVE identifier at this time.
CERT@VDE guidance, Siemens statements, and historical context
CERT@VDE advises owners of the affected WAGO controllers to disable or block FTP on port 21, enforce segmentation controls, and monitor network traffic for anomalies. The research notes that Siemens — which maintains Nucleus — states in its Nucleus advisory that no remediation is planned for Nucleus NET across all versions and that Nucleus ReadyStart V3 releases from V2013.08.1 onward already fix CVE-2021-31886.
The CVE was among 13 disclosed in November 2021 as NUCLEUS:13 by Forescout and Medigate. In earlier research on chaining PLC exploits, Forescout had advised that the issues discussed "should likely not be near the top of your priority list," while adding that AI advances should prompt organizations to reconsider that risk calculus.
Joint agency warnings and the changing operational risk picture
The Vedere Labs work comes after a joint advisory issued August 19 by the NSA, CISA, FBI, Department of Energy, and Environmental Protection Agency, which warned of an active threat to internet-exposed Siemens S7 Series PLCs from AI-generated exploitation scripts. The agencies assessed that the activity was likely intended for persistent reconnaissance and capability development and did not attribute the activity.
The FBI and the EPA separately reported attacks on water utilities in at least seven states since July 27, some of which degraded operations; those attacks changed IP addresses and passwords on internet-facing Rockwell Automation MicroLogix controllers and required no exploit. The authoring agencies warned that "Using AI to generate exploitation scripts represents an evolution in threat actor capabilities, dramatically reducing the technical expertise and time required to develop working ICS exploitation scripts and malicious tools."
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: CERT@VDE's specific recommendations — disable or block FTP on port 21, enforce segmentation, and monitor traffic for anomalies — are immediate, practical steps tied to the devices and flaw named in the advisory.
- Policymakers and regulators: The joint advisory from five agencies signals a broader concern about AI lowering barriers to exploitation; the assessment that the activity is for reconnaissance and capability development suggests a need to consider detection and information-sharing mechanisms.
- Affected enterprises and procurement leaders: The absence of updates for Nucleus V1 RTOS devices and Siemens' statement that no remediation is planned for Nucleus NET underline the operational reality that some deployed controllers may remain unpatchable and require compensating controls.
Forescout's experiment with Claude demonstrates both a capability and a constraint: AI-assisted steering produced a working port of an RCE across PLC models, consumed a quantifiable API cost, and ultimately collided with the real-world consequence of a bricked device. As Forescout put it, "The more immediate risk is not an agent independently deciding to attack a controller, but an authorized agent taking the wrong action on a physical system where failure has real operational consequences."
