Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

Forescout Research - Vedere Labs used Anthropic's Claude to port a working pre-authentication remote code execution exploit from one WAGO programmable logic controller to another, executing attacker-supplied ARM shellcode on live hardware. The exploit targets CVE-2021-31886, a stack-based buffer overflow in the Nucleus FTP server's USER command handling.