AI-Powered Exploit Porting Exposes New WAGO PLC Vulnerability

Detail

, where large language models are compressing the timeline between discovering a flaw and weaponizing it against live hardware. Forescout Research , Vedere Labs has demonstrated this shift by using Anthropic's Claude AI to port a working pre-authentication remote code execution (RCE) exploit from one WAGO programmable logic controller to another, executing attacker-supplied ARM shellcode on physical devices. The finding signals that AI is no longer a theoretical concern in operational technology security , it is a practical force multiplier.

Manual review of the ported exploit suggested the result may be a separate, previously unidentified vulnerability carrying no CVE identifier. That raises urgent questions for asset owners who rely on public vulnerability databases to prioritize patching.

The experiment centered on CVE-2021-31886, a known flaw in WAGO controllers that remains conspicuously absent from public exploit databases. Using Claude, researchers translated the working exploit logic across device models , a task that historically required deep, manual reverse-engineering expertise.

By moving beyond simple code generation into functional exploit porting against real firmware, the work illustrates a critical nuance: AI does not need to be sentient to be dangerous. It only needs to make expert knowledge more accessible and faster to apply.

The most immediate risk is not an autonomous agent independently deciding to attack a controller. It is an authorized agent , human or AI-assisted , taking the wrong action on a physical system where failure carries real operational and safety consequences.

Researchers began with a functioning pre-authentication RCE exploit for a specific WAGO PLC. Claude then assisted in adapting the exploitation chain to a different model within the same product family, ultimately achieving code execution on live hardware with attacker-controlled ARM shellcode.

This cross-model portability matters because OT environments frequently run mixed fleets of controllers. A vulnerability once thought isolated to a single device family may now be expanded with far less effort.