Forescout Uses Claude to Port a Pre-Auth PLC Exploit Between WAGO Controllers for $536 and Eight Hours

WAGO 750-831 programmable logic controller, ported from an existing exploit for the WAGO 750-852

Forescout Research (Vedere Labs) published an experiment testing whether a model could adapt a working pre-authentication remote code execution exploit from one PLC model to a related but distinct one, and it succeeded: attacker-supplied ARM shellcode executed on live hardware. The vulnerability is CVE-2021-31886, a stack-based buffer overflow in the Nucleus FTP server's handling of the USER command, carrying a Siemens-assigned CVSS of 9.8 and reachable before authentication on TCP port 21. Claude Sonnet 4.6 did not get there; Claude Opus 4.6 did. The adaptation that produced the working port was substituting a USER and CWD sequence for the USER and QUIT sequence used against the 750-852, and omitting the CRLF terminator so the relevant processing path never completed normally and the buffer survived long enough for the payload to execute. The final RCE development stage consumed $535.74 in API usage over 8 hours and 32 minutes and required sustained researcher steering throughout. Forescout's own conclusion is deliberately unflattering to the result: a skilled researcher could have done the port faster and cheaper without the model, and could have kept the PLC alive while doing it. Their stated question is what happens as the amount of expert intervention needed keeps falling

Not a vulnerability disclosure. A measured data point on AI-assisted exploit portability against operational technology, where the scarce resource has always been researchers who own the target hardware and understand its firmware, and where a cost curve matters more than a single result