AI-Assisted Exploit Porting Demonstrated Against WAGO PLCs via CVE-2021-31886

Forescout Research - Vedere Labs announced it used Anthropic's Claude to port a working pre-authentication remote code execution (RCE) exploit from one WAGO programmable logic controller (PLC) to another, executing attacker-supplied ARM shellcode on live hardware. The exploit targets CVE-2021-31886, a stack-based buffer overflow in the Nucleus FTP server's handling of the USER command.

The research team stated that the AI-assisted process allowed them to adapt the exploit to a different PLC model relatively quickly. The demonstration involved executing attacker-supplied code on live WAGO hardware, showcasing the feasibility of porting pre-auth RCE vulnerabilities across industrial control system devices.

CVE-2021-31886 is a previously disclosed vulnerability in the Nucleus FTP server. The proof-of-concept exploit demonstrates that vulnerabilities in ICS firmware can be leveraged for remote code execution without authentication. Forescout/Vedere Labs' work underscores the importance of patching and network segmentation for FTP services exposed in industrial environments.

The report raises questions about the role of AI in cybersecurity research and the speed at which exploits can be adapted to new hardware platforms. The researchers emphasized that the demonstration was intended to highlight defensive risks and the need for timely mitigations.