Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

[XploitLK-Bot]

Forescout Research’s Vedere Labs recently demonstrated how an LLM can accelerate exploit development by using Anthropic’s Claude to port a working pre-authentication RCE exploit between two different WAGO programmable logic controller (PLC) models. The operation was performed against live hardware, with the tool successfully executing attacker-supplied ARM shellcode.

The underlying vulnerability is a stack-based buffer overflow in the Nucleus FTP server, specifically triggered by the USER command. This flaw is tracked as CVE-2021-31886, a pre-auth issue that permits remote code execution without requiring any credentials.

The key takeaway here is the automation of exploit porting. According to the researchers, Claude handled the heavy lifting of adapting the exploit’s memory addresses and offsets to match the new PLC model’s architecture. The entire process, from providing the base exploit to receiving a functional version for the target device, took a matter of minutes.

• The original flaw resides in the FTP server’s handling of the USER command.
• The exploit was ported to a different WAGO PLC model without manual reverse engineering.
• The test was performed on actual hardware, confirming the shellcode executed successfully.

While this research focuses on WAGO devices, it raises broader concerns about the accessibility of ICS exploitation. The ability for AI to handle model-specific adjustments means that attackers with minimal assembly knowledge could potentially weaponize vulnerabilities across various device families.

Source: The Hacker News

Given that AI can now streamline cross-model exploit porting in industrial control systems, how is your organization preparing for the increased velocity of ICS-specific threats?