{"id":243500,"date":"2026-09-02T05:32:35","date_gmt":"2026-09-02T10:32:35","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/09\/researchers-use-claude-to-port-preauth-rce-exploit-from-one-plc-model-to-another"},"modified":"2026-09-02T05:32:35","modified_gmt":"2026-09-02T10:32:35","slug":"researchers-use-claude-to-port-preauth-rce-exploit-from-one-plc-model-to-another","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/09\/researchers-use-claude-to-port-preauth-rce-exploit-from-one-plc-model-to-another","title":{"rendered":"Researchers Use Claude to Port PreAuth RCE Exploit From One PLC Model to Another"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/researchers-use-claude-to-port-preauth-rce-exploit-from-one-plc-model-to-another.jpg\"><\/a><\/p>\n<p>Forescout Research \u2014 Vedere Labs said it used Anthropic\u2019s Claude to port a working pre-authentication remote code execution (RCE) exploit from one WAGO programmable logic controller (PLC) to another, executing attacker-supplied ARM shellcode on live hardware.<\/p>\n<p>The exploit targets<strong> CVE-2021\u201331886<\/strong>, a stack-based buffer overflow in the Nucleus FTP server\u2019s handling of the USER command, which carries a Siemens-assigned CVSS score of 9.8 and is accessible before authentication over TCP port 21.<\/p>\n<p>CERT@VDE says no updates are available for the affected WAGO controllers, and advises owners to disable or block FTP on port 21, enforce segmentation controls, and monitor network traffic for anomalies.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Forescout Research \u2014 Vedere Labs said it used Anthropic\u2019s Claude to port a working pre-authentication remote code execution (RCE) exploit from one WAGO programmable logic controller (PLC) to another, executing attacker-supplied ARM shellcode on live hardware. The exploit targets CVE-2021\u201331886, a stack-based buffer overflow in the Nucleus FTP server\u2019s handling of the USER command, which [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1492],"tags":[],"class_list":["post-243500","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/243500","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=243500"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/243500\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=243500"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=243500"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=243500"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}