Researchers Use AI to Port Critical PLC Exploit Across WAGO Models

BERLIN — Security researchers from Forescout Research Vedere Labs successfully demonstrated a new method for adapting industrial control system exploits using artificial intelligence, porting a pre-authentication remote code execution vulnerability from one WAGO programmable logic controller (PLC) model to another. The demonstration, confirmed on Sept. 2, resulted in the execution of ARM shellcode on live hardware, marking a significant escalation in the potential for automated attacks against critical infrastructure.

The researchers utilized the Claude AI system to translate and modify exploit code originally written for a specific WAGO PLC architecture so it would function on a different model within the same product line. Unlike traditional porting methods that require deep manual reverse engineering of proprietary firmware, the AI-driven approach allowed the team to bridge architectural differences rapidly. The successful execution of shellcode indicates that attackers could potentially compromise industrial systems without prior authentication or physical access, bypassing standard security controls.

The incident has drawn immediate attention from German cybersecurity authorities. An advisory issued by CERT@VDE, the national computer emergency response team for the energy sector in Germany, highlighted the severity of the finding. The advisory noted that WAGO PLCs are widely deployed in manufacturing, energy distribution, and transportation networks across Europe. The ability to automate the adaptation of exploits using generative AI lowers the technical barrier for threat actors, potentially enabling less sophisticated groups to target high-value industrial assets.

WAGO has not yet issued a public statement regarding the specific vulnerability or the timeline for patches. However, industry analysts warn that the demonstration underscores a shift in the threat landscape where AI tools can accelerate the weaponization of zero-day vulnerabilities. The Forescout team emphasized that the attack was conducted in a controlled environment to prove the concept, but the mechanics suggest that similar attacks could be launched against unpatched systems in production environments.

The broader implications remain unclear as security vendors race to assess whether other PLC manufacturers face similar risks from AI-assisted exploit adaptation. Questions persist regarding the prevalence of such vulnerabilities across different industrial protocols and whether current defensive measures are sufficient to detect AI-generated attack vectors. As the cybersecurity community digests the findings, the incident serves as a stark warning about the convergence of artificial intelligence and industrial cyber warfare.

Further details on the specific WAGO models affected and the availability of mitigation strategies are expected in the coming days as CERT@VDE coordinates with vendors and affected industries.