Research
Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another
Publication date not yet evaluated · Added thehackernews.com
Page published
Coverage timeline
Single-source research — one report is available.
Why it matters
Forescout's experiment shows that frontier LLMs can meaningfully assist in porting real pre-auth RCE exploits to new industrial control hardware, lowering the bar for adapting ICS attacks even though the process still demands expert steering.
Forescout Research (Vedere Labs) demonstrated using Anthropic's Claude to port a working pre-authentication RCE exploit for CVE-2021-31886 (a CVSS 9.8 stack-based buffer overflow in the Nucleus FTP server) from one WAGO PLC model to another, executing attacker-supplied ARM shellcode on live hardware. The effort required sustained researcher steering and consumed $535.74 in API usage over an 8.5-hour session; a later attempt to build a C2 implant permanently bricked the PLC.