Full Report
Forescout Research - Vedere Labs said it used Anthropic's Claude to port a working pre-authentication remote code execution (RCE) exploit from one WAGO programmable logic controller (PLC) to another, executing attacker-supplied ARM shellcode on live hardware. The exploit targets CVE-2021-31886, a stack-based buffer overflow in the Nucleus FTP server's handling of the USER command
Analysis Summary
# Vulnerability: Stack-based Buffer Overflow in Nucleus FTP Server (WAGO PLC Port)
## CVE Details
- **CVE ID:** CVE-2021-31886
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-121 (Stack-based Buffer Overflow)
## Affected Systems
- **Products:** WAGO Programmable Logic Controllers (PLCs) and other devices utilizing the Nucleus RTOS TCP/IP stack (Nucleus NET).
- **Versions:** All versions of Nucleus FTP Server prior to update releases in late 2021. Specifically demonstrated on WAGO PFC200 series.
- **Configurations:** Systems with the FTP service enabled and accessible via the network.
## Vulnerability Description
The vulnerability exists within the Nucleus FTP server's handling of the `USER` command. The software fails to properly validate the length of the username string provided by the client before copying it into a fixed-size stack buffer. An attacker can send a specially crafted, overly long `USER` command to trigger a stack-based buffer overflow. This allows for the overwriting of the return address on the stack, leading to arbitrary code execution (RCE) prior to authentication.
## Exploitation
- **Status:** PoC Available. Research by Forescout’s Vedere Labs demonstrated that LLMs (Anthropic's Claude) can be used to port existing exploits across different hardware architectures (e.g., from one PLC model to another) by adjusting shellcode for specific ARM memory layouts.
- **Complexity:** Low (Pre-authentication; no credentials required).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Total compromise of the device data).
- **Integrity:** High (Ability to modify PLC logic or system firmware).
- **Availability:** High (Ability to crash the device or disrupt industrial processes).
## Remediation
### Patches
- **WAGO:** Apply firmware updates that incorporate the patched Nucleus RTOS stack. Users should consult the WAGO PSIRT for specific firmware versions per device model (typically firmware versions released after late 2021).
- **Siemens (Nucleus RTOS owner):** Updates were released for the Nucleus RTOS source code to address "Infra:Halt" vulnerabilities.
### Workarounds
- **Disable FTP:** If the FTP service is not required for operations, disable it via the device management interface.
- **Network Segmentation:** Place PLCs behind industrial firewalls and restrict access to the FTP port (TCP 21) to authorized management workstations only.
## Detection
- **Indicators of Compromise:**
- Unusual network traffic patterns involving exceptionally long strings sent to TCP port 21.
- Unexpected device reboots or service crashes.
- **Detection Methods:**
- **IDS/IPS:** Deploy signatures designed to detect overly long `USER` commands in FTP traffic.
- **Forescout eyeInspect:** Can be used to identify vulnerable versions of the Nucleus stack via passive network monitoring.
## References
- **WAGO PSIRT:** hxxps[://]www[.]wago[.]com/global/psirt
- **Forescout Research (Vedere Labs):** hxxps[://]www[.]forescout[.]com/blog/leveraging-llms-for-exploit-porting/
- **NIST NVD:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2021-31886