Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

Researchers at Forescout Research - Vedere Labs have successfully used Claude to adapt a pre-authentication remote code execution exploit from one model of WAGO programmable logic controller to another. The exploit targets a stack-based buffer overflow vulnerability in the Nucleus FTP server. This allowed the researchers to execute attacker-supplied ARM shellcode on live hardware. The vulnerability being exploited is related to the handling of the USER command. The exploit specifically targets a known vulnerability, which was previously identified. The researchers were able to achieve this using Anthropic's Claude.