Forescout Uses Claude to Port RCE Across WAGO PLCs

WAGO makes PLCs found in substations, water treatment plants, and factory floors that have been running the same firmware stack for years, sometimes well past the vendor’s intended support window. That’s not unusual for OT. It’s the physical layer: once a controller is in production, the replacement cycle is measured in years, not quarters.

Forescout Research’s Vedere Labs published a finding on September 2 showing that Claude could adapt a working pre-authentication remote code execution exploit from one WAGO PLC model to a different WAGO model, according to The Hacker News. Forescout did not publish exploit code.

Why hardware variants matter, and why this changes things

Two WAGO PLC models can share a vulnerability class while differing in firmware offsets, memory layout, and protocol handling. A working exploit for model A needs to account for those differences before it runs reliably against model B. Historically, that gap required a researcher with hands-on knowledge of the second device’s internals: the kind of understanding built through hardware access and hours of reversing, not a prompt.

That’s what Claude compressed. The Vedere Labs work doesn’t introduce new vulnerabilities into WAGO products. It demonstrates that adapting an existing exploit across hardware variants no longer requires the same depth of specialist labor.

What breaks in PLC patching when that gap closes

PLC firmware updates in production OT environments are not like server patch cycles. They require planned downtime, sometimes hours of it. In manufacturing and utilities, that means coordinating with operations teams, often scheduling months out. In some environments, a firmware update requires a vendor technician on-site.

The standard advice has been to patch urgently when a working exploit exists for your specific hardware. Defenders have relied on a window: time between “PoC published for model A” and “someone ports it to model B.” That window was real and meaningful. It bought time for approval processes, maintenance windows, and change management.

Vedere Labs’ research makes that window less reliable to count on. The porting work that used to take weeks of specialist effort can now move faster.

The NSA and FBI warned in August that AI tools were being used to accelerate attacks against Siemens PLCs specifically. Vedere Labs’ WAGO demonstration is a concrete example of the same capability operating across a different vendor’s hardware line.

What to do

Start with inventory. Know which WAGO products are in your environment and which firmware versions they’re running. That’s the prerequisite for any response.

Check WAGO’s security advisories for affected products and apply available firmware updates. If a maintenance window is scheduled months out, move it up; waiting for the next planned slot is harder to justify when the exploit-porting timeline is shrinking.

Confirm that no WAGO controller is directly reachable from a routable network. Firewall the engineering workstation from the controller; a data diode on the outbound path if the environment supports it.

The CISA July advisory on water system PLC attacks covers network segmentation requirements for utility OT in detail. The guidance there applies directly to the target profile Vedere Labs tested against.

Operators who have been treating “no PoC for our specific model” as a reason to defer patching: that reasoning has less operational runway than it did a week ago.