Claude Code Exploit Ported an Older Flaw Between WAGO PLCs in a Lab

Claude Code exploit, according to reports from SecurityWeek and The Hacker News, enabled researchers to port an existing laboratory exploit for CVE-2021-31886 from a WAGO 750-852 PLC to a physical WAGO 750-831 device. On the target PLC, they achieved controlled code execution under human supervision. The demonstration does not represent a new vulnerability or confirmation of real-world exploitation in industrial operations.

CVE-2021-31886 affects the Nucleus FTP server. An unchecked USER command length can lead to a stack overflow and subsequently to denial of service or remote code execution. CERT@VDE previously listed WAGO models 750-831 and 750-852 among the affected devices in specified older firmware versions.

Claude Code exploit was based on an older CVE

This did not involve creating an attack against a previously unknown flaw. According to available information, the researchers started with an exploit used in earlier research on the WAGO 750-852 model and adapted it to the related 750-831 PLC. Forescout’s original NUCLEUS:13 research documented the technical nature of the flaw in the Nucleus TCP/IP stack and earlier testing on a WAGO device.

SecurityWeek reports that the experiment’s final phase took more than eight hours and that API costs exceeded $500. The researchers did not proceed without intervention: a human continuously checked the results. Secondary reports provide details about the tool, costs, and process based on statements from Forescout; however, no independently verifiable first-party report on this specific experiment was available.

The test did not produce a functional implant

According to The Hacker News, the demonstrated capability ended with sending network packets and controlled code execution. In a subsequent attempt to create a C2 implant, the researchers reportedly damaged the tested PLC by writing to an area mapped to flash memory. The device was consequently irreparably damaged.

This result is an important limitation when interpreting the experiment. It does not mean that the tool can autonomously and reliably develop usable exploits for arbitrary industrial control systems. In the described case, an existing laboratory exploit was adapted between related models, and expert guidance was required.

The risk mainly concerns older and accessible devices

PLCs control physical industrial processes, so even laboratory code capable of remote code execution has operational significance. The damage to the device during testing also shows that inaccurate interventions in a control system can have consequences even without successfully creating a persistent malicious mechanism.

Operators of older WAGO 750-831 and 750-852 PLCs should verify whether the FTP service is exposed on the network and check network segmentation. The current patch status for all affected legacy devices was not independently confirmed within the available materials. An earlier CERT@VDE alert describes the affected firmware; this case, however, cannot be presented as a new patch.

Further developments will show whether Forescout publishes a technical report with a reproducible methodology, whether WAGO or CERT@VDE issue new statements on mitigations and firmware, and, above all, whether credible evidence emerges of real-world exploitation of CVE-2021-31886 or an exploit ported in this way.

Verified and updated: 09/02/2026 11:28