Forescout Research – Vedere Labs has demonstrated something every OT defender needs to internalize immediately: they used Anthropic's Claude to port a working pre-authentication remote code execution exploit from one WAGO programmable logic controller model to another — and landed attacker-supplied ARM shellcode on live hardware. The underlying flaw is CVE-2021-31886, a stack-based buffer overflow in the Nucleus FTP server's handling of the USER command.
The vulnerability itself isn't new. What is new — and what should fundamentally change your risk calculus — is that an AI model successfully performed one of the hardest tasks in exploit development: cross-model exploit porting. This requires understanding architecture differences, memory layouts, instruction encodings, and target-specific offsets. Historically, that work took skilled researchers days or weeks per target. It has now been compressed into an assisted workflow that a far less experienced operator could replicate.
If your defensive strategy assumes that model-specific OT exploits stay confined to the exact firmware variant they were built against, that assumption is now dead. Any organization running WAGO PFC controllers — or any device built on the Nucleus RTOS FTP stack — must treat unpatched, network-reachable FTP services as an imminent pre-auth compromise path.
Technical Analysis
The Vulnerability: CVE-2021-31886
CVE-2021-31886 is a stack-based buffer overflow in the FTP server component of the Nucleus RTOS TCP/IP stack (Nucleus NET), originally disclosed as part of Forescout's broader Nucleus:13 research into embedded TCP/IP stacks. The flaw exists in the server's parsing of the FTP USER command: an attacker who sends an oversized username string overruns a fixed-size stack buffer, gaining control of execution flow without any authentication.
Key characteristics from a defender's perspective:
- Attack vector: Network, TCP/21 (FTP)
- Authentication required: None — the overflow triggers during the login handshake, before credentials are validated
- Affected component: Nucleus NET FTP server (ftpserver) embedded in Nucleus RTOS-based firmware
- Affected products: WAGO programmable logic controllers built on Nucleus RTOS, including the PFC100 (750-81xx) and PFC200 (750-82xx) controller families, along with other vendors' devices embedding the same Nucleus FTP stack
- Impact: Remote, unauthenticated code execution at the firmware level — full device compromise
What Forescout Actually Did
The critical detail in this research is not the bug — it's the porting exercise. Forescout took a known working exploit for one WAGO PLC model and used Claude as an exploitation co-pilot to adapt it to a different model. The AI assisted with:
- Analyzing firmware differences between the two PLC models
- Recomputing stack offsets and return addresses for the new target
- Adapting and generating ARM shellcode appropriate to the new device's architecture
- Validating execution on live hardware
This matters because the historical economics of OT exploitation protected defenders in a perverse way: a PoC for one controller model rarely worked on another without substantial manual reverse engineering. Adversaries had to invest scarce talent per-target. AI-assisted porting removes that friction, effectively turning every published single-model PoC into a multi-model exploit kit in waiting.
Exploitation Status
- In-the-wild exploitation: No confirmed mass exploitation of CVE-2021-31886 is reported as of this writing. However, working pre-auth exploit code exists, has now been proven portable across models, and the technique is reproducible by any motivated actor with access to a capable LLM.
- CISA KEV: Not currently listed, but Nucleus RTOS components have been the subject of multiple CISA ICS advisories.
- Threat model shift: The window between "PoC exists for model X" and "working exploit exists for models X, Y, and Z" has shrunk from weeks of expert labor to hours of AI-assisted iteration. Prioritize accordingly.
Detection & Response
OT environments present a detection challenge: you cannot install EDR on a PLC. Detection must happen at the network layer — Zeek/Suricata sensors, firewall logs ingested into your SIEM, and monitoring of the engineering workstations and jump boxes that legitimately touch these devices.
The most reliable pre-exploitation indicator for this specific attack is an abnormally long FTP USER command targeting an OT asset. Legitimate FTP usernames are short; the exploit requires an oversized username to smash the stack. Any USER argument beyond ~64 bytes headed to a PLC is, in my experience, either a misconfigured scanner or an attack.
Sigma Rules
---
title: Oversized FTP USER Command to OT Asset - Potential CVE-2021-31886 Exploitation
id: 8f2c4a71-3b6d-4e9a-b1c7-5d8e2f4a9c31
status: experimental
description: Detects abnormally long FTP USER command arguments directed at OT/ICS assets, consistent with the stack-based buffer overflow in the Nucleus FTP server (CVE-2021-31886) exploited via oversized username strings against WAGO PLCs.
references:
- https://thehackernews.com/2026/09/researchers-use-claude-to-port-pre-auth.html
- https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/09/08
tags:
- attack.initial_access
- attack.t1190
logsource:
product: zeek
service: ftp
detection:
selection:
command: 'USER'
arg|windash: '-'
arg_length|gt: 64
filter_known_scanner:
user|contains:
- 'nessus'
- 'qualys'
- 'rapid7'
condition: selection and not filter_known_scanner
falsepositives:
- Vulnerability scanners performing FTP banner or fuzzing checks (tune via filter)
- Legacy industrial applications with long service-account usernames
level: high
---
title: Unexpected FTP Session Initiated Toward PLC Network Segment
id: 3a7b1d94-5c2e-4f8a-9d3b-6e1c4a7f2b85
status: experimental
description: Detects FTP (TCP/21) connection attempts toward OT controller subnets from hosts outside the authorized engineering workstation/jump-host allowlist. WAGO PFC controllers expose the Nucleus FTP service by default; any non-allowlisted source is anomalous.
references:
- https://thehackernews.com/2026/09/researchers-use-claude-to-port-pre-auth.html
- attack.mitre.org/techniques/T0846/
author: Security Arsenal
date: 2026/09/08
tags:
- attack.lateral_movement
- attack.t0846
logsource:
category: firewall
detection:
selection:
dst_port: 21
dst_ip|cidr:
- '10.10.0.0/16' # TODO: replace with your OT/PLC VLAN CIDRs
- '172.16.32.0/24'
filter_authorized:
src_ip:
- '10.1.5.10' # TODO: replace with engineering workstation / jump-host IPs
- '10.1.5.11'
condition: selection and not filter_authorized
falsepositives:
- New engineering workstations not yet added to the allowlist
- Firmware deployment tools during maintenance windows
level: medium
---
title: FTP Session Followed by Controller Unresponsiveness - Post-Exploitation Crash Artifact
id: 6d4e8a12-7f3b-4c5d-8a2e-9b1c3f5d7e49
status: experimental
description: Correlates an FTP connection to an OT asset with a subsequent failed connection pattern, indicating the target PLC crashed or rebooted after a buffer overflow attempt (successful or failed). Failed exploit attempts against Nucleus FTP frequently fault the device.
references:
- https://thehackernews.com/2026/09/researchers-use-claude-to-port-pre-auth.html
author: Security Arsenal
date: 2026/09/08
tags:
- attack.impact
- attack.t1499
logsource:
category: firewall
detection:
selection:
dst_port: 21
action: 'allowed'
condition: selection
falsepositives:
- Maintenance activity followed by scheduled controller reboots
level: low
A note on the third rule: treat it as a correlation candidate, not a standalone alert. In production, pair it with a second firewall/Syslog event showing the same destination refusing connections within 60 seconds — that pairing is your high-fidelity crash indicator.
KQL — Microsoft Sentinel (CEF/Syslog/Firewall ingestion)
This query hunts for oversized FTP USER commands and anomalous FTP flows toward OT segments via ingested firewall/Zeek logs. Adjust the OT CIDR and allowlist variables for your environment.
let OT_Segments = dynamic(["10.10.0.0/16", "172.16.32.0/24"]);
let Authorized_FTP_Sources = dynamic(["10.1.5.10", "10.1.5.11"]);
let FTP_Flows = CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort == 21
| where ipv4_is_in_any_range(DestinationIP, OT_Segments)
| where not(SourceIP in~ (Authorized_FTP_Sources))
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Message, DeviceVendor, DeviceProduct;
FTP_Flows
| extend USER_Arg_Length = extract(@"USER\s+(.{65,})", 1, Message)
| extend Suspicious_Long_USER = isnotempty(USER_Arg_Length)
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
Attempts = count(), HasLongUSER = max(Suspicious_Long_USER),
SampleMessages = make_set(Message, 5)
by SourceIP, DestinationIP
| extend Verdict = case(
HasLongUSER == true, "CRITICAL - Possible CVE-2021-31886 overflow attempt",
Attempts > 20, "HIGH - Repeated FTP probing of OT asset",
"MEDIUM - Unauthorized FTP source to OT segment")
| order by HasLongUSER desc, Attempts desc
Run a second query against Syslog for controller-side artifacts — Nucleus-based PLCs and WAGO devices that forward logs will sometimes emit task-fault or reboot messages after a failed overflow:
Syslog
| where TimeGenerated > ago(7d)
| where HostIP has_any ("10.10.", "172.16.32.")
| where SyslogMessage has_any ("task fault", "exception", "reboot", "watchdog", "ftp", "stack")
| summarize EventCount = count(), Samples = make_set(SyslogMessage, 5)
by HostName, HostIP, Facility, SeverityLevel
| order by EventCount desc
Velociraptor VQL — Engineering Workstation Hunt
You can't run Velociraptor on a PLC, but you absolutely should run it on the Windows engineering workstations and jump boxes that bridge IT and OT. These are the most likely staging points for an attacker running an FTP exploit and shellcode payload. This artifact hunts for active FTP connections to OT assets and for exploit-tooling artifacts (Python scripts, raw shellcode files, FTP client command histories) on those hosts.
-- Hunt: FTP exploitation staging on OT-adjacent workstations
-- Targets connections to PLC FTP services and on-disk exploit artifacts
LET plc_targets = ('10.10.', '172.16.32.') -- TODO: your OT prefixes
LET ftp_connections = SELECT Pid, Name, Path,
Family, Type, Status,
Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort
FROM netstat()
WHERE RemotePort = 21
AND array_func(array=plc_targets,
cb="x=>RemoteIP =~ x")
LET suspect_files = SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
'C:/Users/*/Downloads/**/shellcode*',
'C:/Users/*/Downloads/**/*.bin',
'C:/Users/*/Desktop/**/*exploit*.py',
'C:/Users/*/Documents/**/*exploit*.py',
'C:/Tools/**/*.py',
'C:/Temp/**/*.bin'
])
WHERE Mtime > now() - 604800 -- last 7 days
SELECT 'FTP_CONNECTION' AS ArtifactType,
format(format="%v -> %v:%v", args=[LocalIP, RemoteIP, RemotePort]) AS Detail,
Name AS Process, Pid, NULL AS FilePath, NULL AS Mtime
FROM ftp_connections
UNION ALL
SELECT 'SUSPECT_FILE' AS ArtifactType,
NULL AS Detail, NULL AS Process, NULL AS Pid,
FullPath AS FilePath, Mtime
FROM suspect_files
Remediation & Verification Script (Bash)
Run this from a Linux jump host or security sensor with network reachability to the OT segment. It discovers WAGO/Nucleus FTP services, fingerprints them, and verifies that compensating firewall rules are in place. Read-only — it makes no changes to OT devices.
#!/bin/bash
# wago-ftp-exposure-audit.sh
# Audits OT segments for exposed Nucleus FTP services (CVE-2021-31886 attack surface)
# and verifies compensating controls. READ-ONLY. Authorized use only.
set -euo pipefail
# ---- CONFIGURE THESE ----
OT_CIDRS=("10.10.0.0/16" "172.16.32.0/24")
OUTFILE="wago_ftp_audit_$(date +%Y%m%d_%H%M%S).csv"
# -------------------------
echo "[*] Phase 1: Discovering live FTP services (TCP/21) in OT segments..."
echo "ip,port,state,banner_or_product" > "$OUTFILE"
for cidr in "${OT_CIDRS[@]}"; do
echo " Scanning $cidr (service detection, no intrusive scripts)..."
nmap -Pn -p21 --open -sV --version-light -oG - "$cidr" 2>/dev/null \
| awk '/21\/open/ {
ip=$2;
svc="unknown";
for(i=1;i<=NF;i++){ if($i ~ /ftp/i){ svc=svc" "$i } }
print ip",21,open,"svc
}' >> "$OUTFILE"
done
FOUND=$(tail -n +2 "$OUTFILE" | wc -l)
echo "[+] FTP services discovered: $FOUND -> $OUTFILE"
echo "[*] Phase 2: Banner grab for Nucleus/WAGO fingerprints (passive connect, no auth)..."
while IFS=, read -r ip port state banner; do
[ "$ip" = "ip" ] && continue
BANNER=$(timeout 5 bash -c "exec 3<>/dev/tcp/$ip/21; head -c 200 <&3" 2>/dev/null | tr -d '\r\n' || echo "no-banner")
if echo "$BANNER" | grep -Eiq 'nucleus|wago|220.*ftp'; then
echo "[!] $ip — FTP banner: $BANNER <-- REVIEW for CVE-2021-31886 exposure"
fi
done < "$OUTFILE"
echo "[*] Phase 3: Compensating-control check — can a NON-engineering host reach port 21?"
echo " (Run this script from a host OUTSIDE the engineering allowlist)"
FAIL=0
while IFS=, read -r ip port state banner; do
[ "$ip" = "ip" ] && continue
if timeout 3 bash -c "echo > /dev/tcp/$ip/21" 2>/dev/null; then
echo "[FAIL] $ip:21 reachable from this (unauthorized) host — segmentation gap!"
FAIL=1
fi
done < "$OUTFILE"
[ "$FAIL" -eq 0 ] && echo "[PASS] No FTP reachability from unauthorized vantage point."
echo "[*] Audit complete. Results: $OUTFILE"
echo " Next: cross-reference found devices against WAGO firmware advisory and patch status."
Remediation
1. Patch — This Is Non-Negotiable
WAGO addressed the Nucleus:13 FTP vulnerabilities, including CVE-2021-31886, in firmware updates for the PFC100/PFC200 families. Action items:
- Inventory immediately. Identify every WAGO PFC100 (750-81xx) and PFC200 (750-82xx) controller, plus any other Nucleus RTOS-based device, in your environment. If you don't have a passive OT asset inventory, the discovery script above is your starting point.
- Apply current WAGO firmware. Reference the official WAGO security advisories at https://www.wago.com/global/automation-technology/security and the CISA ICS advisories covering Nucleus:13 (search ICS-CERT for CVE-2021-31886 / Nucleus FTP). Given today's AI-assisted porting reality, treat any controller still running vulnerable firmware as actively at risk, not legacy debt.
- Don't assume "different model = safe." That is precisely the assumption this research demolished. If one model in your fleet has a published exploit, assume a working exploit for your model is hours away for a motivated adversary.
2. Disable or Restrict the FTP Service
- If FTP is not operationally required on the controller, disable it. The Nucleus FTP server is the attack surface; removing it removes the vulnerability's reachability regardless of patch state.
- If FTP is required (legacy file transfer workflows), restrict TCP/21 to a strict source allowlist of engineering workstations via firewall ACLs or the controller's own firewall configuration, and place those transfers on a change-managed schedule.
3. Segment and Monitor
- Enforce deny-by-default between IT and OT zones, with FTP to controllers permitted only from hardened jump hosts (IEC 62443 zone/conduit model).
- Deploy passive network monitoring (Zeek/Suricata) at the OT boundary with the FTP USER-length detection logic from the Sigma rules above. Oversized FTP commands are a near-zero-false-positive indicator in industrial environments.
- Forward controller Syslog to your SIEM and alert on unexpected reboots, task faults, and watchdog events — a failed buffer overflow attempt frequently crashes the device.
4. Strategic Shift: Recalibrate Patch SLAs for OT
The real lesson of this research is economic. AI assistance is collapsing the cost of exploit adaptation. Your vulnerability management program should respond:
- Pre-auth RCE in network-exposed OT services should now carry the same remediation urgency as internet-facing IT assets — target days, not maintenance-window quarters.
- Include exploit-portability risk in your vulnerability triage scoring. A PoC against a sibling model or sibling firmware version is no longer "not applicable to us" — it is a demonstrated, AI-accelerable exploit path.
- Pressure vendors for coordinated disclosure timelines and SBOMs so you know which of your devices embed shared stacks like Nucleus NET in the first place.
Organizations that treat AI-assisted exploit development as a novelty will be re-learning this lesson during an incident. The tooling to weaponize a five-year-old OT vulnerability against hardware it was never built for now fits in a chat window. Patch, segment, and monitor like that's already being used against you — because for pre-auth PLC bugs, it will be.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.